CVE-2022-41091KEV · OVERDUECWE-863broken-access-control

Microsoft Windows Mark of the Web (MOTW) Security Feature Bypass Vulnerability

Medium · published November 10, 2022

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 5.4. It is confirmed in active exploitation. It sits in the 79.6th percentile for exploit probability.

1416
days past CISA
deadline
CVSS v3.1
5.4
EPSS
2%
Percentile
79.6
In the wild
Confirmed
What it is

⚠️ A crafty bypass lets attackers sidestep Windows' security warnings — think of it as a pizza delivery that skips the doorbell and sneaks right inside! 🍕 Imagine your home has a security system that fails to alert you when someone walks in through the back door without knocking. This vulnerability is like that sneaky visitor bypassing all your precautions, leaving you exposed! An attacker could exploit this bypass to run untrusted files without raising alarms, putting your system at risk of malware or data leaks. While it's not catastrophic, the potential for malicious activity is definitely a concern!

Put simply

Imagine your home has a security system that fails to alert you when someone walks in through the back door without knocking. This vulnerability is like that sneaky visitor bypassing all your precautions, leaving you exposed! This vulnerability allows an attacker to bypass the Mark of the Web feature, which is designed to warn users about files downloaded from the internet. This could let harmful content execute without the usual security prompts.

What to do

An attacker could exploit this bypass to run untrusted files without raising alarms, putting your system at risk of malware or data leaks. While it's not catastrophic, the potential for malicious activity is definitely a concern! To protect your system, ensure you're running the latest Windows updates that address this vulnerability. Also, audit your file handling policies to ensure extra layers of checks are in place. Don't let those sneaky deliveries surprise you! This is manageable! Stay proactive, keep your systems updated, and you’ll keep those uninvited guests at bay. 🛡️

The record
Technical detail
CVSS v3.1
5.4 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L
CVSS v4.0
Not supplied
EPSS
0.01910 · 79.6th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2022-11-10T03:15Z
KEV added
2022-11-08 · due 2022-12-09
Affected products (12)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.1956710.0.10240.19567
microsoft/windows_10_1607< 10.0.14393.550110.0.14393.5501
microsoft/windows_10_1809< 10.0.17763.365010.0.17763.3650
microsoft/windows_10_20h2< 10.0.19042.225110.0.19042.2251
microsoft/windows_10_21h1< 10.0.19043.225110.0.19043.2251
microsoft/windows_10_21h2< 10.0.19044.225110.0.19044.2251
microsoft/windows_10_22h2< 10.0.19045.225110.0.19045.2251
microsoft/windows_11_21h2< 10.0.22000.121910.0.22000.1219
microsoft/windows_11_22h2< 10.0.22621.81910.0.22621.819
microsoft/windows_server_2016< 10.0.14393.550110.0.14393.5501
microsoft/windows_server_2019< 10.0.17763.365010.0.17763.3650
microsoft/windows_server_2022< 10.0.20348.124910.0.20348.1249
References (3)
EPSS history
Timeline
  • 09 NOV 00:00Z
    Windows Mark of the Web Security Feature Bypass Vulnerability
    cvelistv5
  • 08 NOV 00:00Z
    Added to CISA KEV — remediate by Dec 9
    kev