CVE-2022-30190highbajo ataqueransomware

CVE-2022-30190: fallo de gravedad alta en Microsoft Windows 10 Version 1507

Microsoft Windows Support Diagnostic Tool (MSDT) Remote Code Execution Vulnerability

Publicada el · Actualizada el

Seguir esta CVE+ Monitorear Windows Server+ Monitorear Windows

Aviso por correo cuando entre en el KEV, tenga PoC pública o suba de nota.

100Vexday Risk Score

Corrige ahora. Ella está bajo explotación confirmada por CISA y tiene exploit funcional público.

ssvc Actcvss 7.8epss 99%
de la publicación al armael mismo día
Publicada en NVD1 jun
1ª PoC30 may
metasploit29 may
CISA KEV+13d
Acción exigida por CISAplazo federal: 2022-07-05

Apply updates per vendor instructions.

En resumen

La Herramienta de Diagnóstico de Soporte de Microsoft (MSDT) puede ser engañada para ejecutar código malicioso cuando se abre a través de un enlace en aplicaciones como Word. Un atacante puede explotar esto para tomar control de su computadora y robar datos o instalar software dañino.

Detalle técnico

Una vulnerabilidad de ejecución remota de código en MSDT activada mediante manipulación del protocolo URL desde aplicaciones como Microsoft Word permite que atacantes no autenticados ejecuten código arbitrario con los privilegios del proceso llamador. La explotación requiere interacción del usuario (apertura de un enlace o documento malicioso), pero resulta en capacidad completa de ejecución de código dentro del contexto de seguridad del usuario.

Resumen generado y traducido por IA a partir de la descripción oficial.

El análisis completo de esta CVE está disponible en portugués →

A remote code execution vulnerability exists when MSDT is called using the URL protocol from a calling application such as Word. An attacker who successfully exploits this vulnerability can run arbitrary code with the privileges of the calling application. The attacker can then install programs, view, change, or delete data, or create new accounts in the context allowed by the user’s rights. Please see the MSRC Blog Entry for important information about steps you can take to protect your system from this vulnerability.
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
Productos afectados
Microsoft · Windows 10 Version 1507Microsoft · Windows 10 Version 1607Microsoft · Windows 10 Version 1809Microsoft · Windows 10 Version 20H2Microsoft · Windows 10 Version 21H1Microsoft · Windows 10 Version 21H2Microsoft · Windows 11 version 21H2Microsoft · Windows 7Microsoft · Windows 7 Service Pack 1Microsoft · Windows 8.1Microsoft · Windows Server 2008 R2 Service Pack 1Microsoft · Windows Server 2008 R2 Service Pack 1 (Server Core installation)Microsoft · Windows Server 2012Microsoft · Windows Server 2012 R2Microsoft · Windows Server 2012 R2 (Server Core installation)Microsoft · Windows Server 2012 (Server Core installation)Microsoft · Windows Server 2016Microsoft · Windows Server 2016 (Server Core installation)Microsoft · Windows Server 2019Microsoft · Windows Server 2019 (Server Core installation)Microsoft · Windows Server 2022Microsoft · Windows Server version 20H2
PoCs públicas encontradas — 145
githubgithub.com/komomon/CVE-2022-30190-follina-Office-MSDT-Fixed★ 390githubgithub.com/JMousqueton/PoC-CVE-2022-30190★ 157githubgithub.com/onecloudemoji/CVE-2022-30190★ 105githubgithub.com/doocop/CVE-2022-30190★ 60githubgithub.com/Malwareman007/Deathnote★ 38githubgithub.com/archanchoudhury/MSDT_CVE-2022-30190★ 38githubgithub.com/Hrishikesh7665/Follina_Exploiter_CLI★ 33githubgithub.com/MalwareTech/FollinaExtractor★ 31githubgithub.com/ErrorNoInternet/FollinaScanner★ 23githubgithub.com/Noxtal/follina★ 21githubgithub.com/0xflagplz/MS-MSDT-Office-RCE-Follina★ 20githubgithub.com/dwisiswant0/gollina★ 17githubgithub.com/aminetitrofine/CVE-2022-30190★ 12githubgithub.com/drgreenthumb93/CVE-2022-30190-follina★ 8githubgithub.com/abbarhissarh/FollinaXploit★ 8githubgithub.com/Gra3s/CVE-2022-30190_EXP_PowerPoint★ 8githubgithub.com/sudoaza/CVE-2022-30190★ 7githubgithub.com/ItsNee/Follina-CVE-2022-30190-POC★ 6githubgithub.com/PaddlingCode/cve-2022-30190★ 6githubgithub.com/DerZiad/CVE-2022-30190★ 6githubgithub.com/AbdulRKB/Follina★ 5githubgithub.com/Cosmo121/Follina-Remediation★ 4githubgithub.com/sentinelblue/CVE-2022-30190★ 4githubgithub.com/dsibilio/follina-spring★ 4githubgithub.com/rouben/CVE-2022-30190-NSIS★ 3githubgithub.com/EkamSinghWalia/Follina-MSDT-Vulnerability-CVE-2022-30190-★ 3githubgithub.com/jeffreybxu/five-nights-at-follina-s★ 2githubgithub.com/swaiist/CVE-2022-30190-Fix★ 2githubgithub.com/Zitchev/go_follina★ 2githubgithub.com/gyaansastra/CVE-2022-30190★ 2githubgithub.com/SonicWave21/Follina-CVE-2022-30190-Unofficial-patch★ 2githubgithub.com/amitniz/follina_cve_2022-30190★ 2githubgithub.com/arozx/CVE-2022-30190★ 2githubgithub.com/gamingwithevets/msdt-disable★ 2githubgithub.com/winstxnhdw/CVE-2022-30190★ 2githubgithub.com/SrikeshMaharaj/CVE-2022-30190★ 2githubgithub.com/suenerve/CVE-2022-30190-Follina-Patch★ 2githubgithub.com/melting0256/Enterprise-Cybersecurity★ 1githubgithub.com/IamVSM/msdt-follina★ 1githubgithub.com/joshuavanderpoll/CVE-2022-30190★ 1githubgithub.com/ImVihanga03/Static-Malware-Analysis-Follina-CVE-2022-30190★ 1githubgithub.com/rickhenderson/cve-2022-30190★ 1githubgithub.com/alienkeric/CVE-2022-30190★ 1githubgithub.com/kdk2933/msdt-CVE-2022-30190★ 1githubgithub.com/Jump-Wang-111/AmzWord★ 1githubgithub.com/Muhammad-Ali007/Follina_MSDT_CVE-2022-30190★ 1githubgithub.com/b401/Clickstudio-compromised-certificate★ 1githubgithub.com/hycheng15/CVE-2022-30190★ 1githubgithub.com/ToxicEnvelope/FOLLINA-CVE-2022-30190★ 1githubgithub.com/ITMarcin2211/CVE-2022-30190★ 1githubgithub.com/derco0n/mitigate-folina★ 1githubgithub.com/michealadams30/Cve-2022-30190★ 1githubgithub.com/mitespsoc/CVE-2022-30190-POC★ 0githubgithub.com/nimesh895/Malware-Analysis-Follina-CVE-2022-30190★ 0githubgithub.com/bcarrulo/Lab-CVE-2022-30190★ 0githubgithub.com/2867a0/CVE-2022-30190★ 0githubgithub.com/DOV3Y/CVE-2022-30190-ASR-Senintel-Process-Pickup★ 0githubgithub.com/aymankhder/MSDT_CVE-2022-30190-follina-★ 0githubgithub.com/hscorpion/CVE-2022-30190★ 0githubgithub.com/Vaisakhkm2625/MSDT-0-Day-CVE-2022-30190-Poc★ 0githubgithub.com/rayorole/CVE-2022-30190★ 0githubgithub.com/ImproveCybersecurityJaro/2022_PoC-MSDT-Follina-CVE-2022-30190★ 0githubgithub.com/castlesmadeofsand/ms-msdt-vulnerability-pdq-package★ 0githubgithub.com/WesyHub/CVE-2022-30190---Follina---Poc-Exploit★ 0githubgithub.com/droidrzrlover/CVE-2022-30190★ 0githubgithub.com/hilt86/cve-2022-30190-mitigate★ 0githubgithub.com/tej7gandhi/CVE-2022-30190-Zero-Click-Zero-Day-in-msdt★ 0githubgithub.com/abhirules27/Follina★ 0githubgithub.com/sentrium-security/Follina-Workaround-CVE-2022-30190★ 0githubgithub.com/cyberdashy/CVE-2022-30190★ 0githubgithub.com/Abdibimantara/CVE-2022-30190-Analysis-With-LetsDefends-Lab★ 0githubgithub.com/JotaQC/CVE-2022-30190_Temporary_Fix★ 0githubgithub.com/JotaQC/CVE-2022-30190_Temporary_Fix_Source_Code★ 0githubgithub.com/nanaao/PicusSecurity4.Week.Repo★ 0githubgithub.com/ernestak/CVE-2022-30190★ 0githubgithub.com/ernestak/Sigma-Rule-for-CVE-2022-30190★ 0githubgithub.com/notherealhazard/follina-CVE-2022-30190★ 0githubgithub.com/Cerebrovinny/follina-CVE-2022-30190★ 0githubgithub.com/Imeneallouche/Follina-attack-CVE-2022-30190-★ 0githubgithub.com/mattjmillner/CVE-Smackdown★ 0githubgithub.com/Nyx2022/Follina-CVE-2022-30190-Sample★ 0githubgithub.com/yrkuo/CVE-2022-30190★ 0githubgithub.com/shri142/ZipScan★ 0githubgithub.com/ethicalblue/Follina-CVE-2022-30190-Sample★ 0githubgithub.com/Potato-9257/CVE-2022-30190_page★ 0githubgithub.com/yeep1115/ICT287_CVE-2022-30190_Exploit★ 0githubgithub.com/RathoreAbhiii/Folina-Vulnerability-Exploitation-Detection-and-Mitigation★ 0githubgithub.com/seinab-ibrahim/Follina-Vulnerability-CVE-2022-30190-Exploit-Analysis★ 0githubgithub.com/Arkha-Corvus/LetsDefend-SOC173-Follina-0-Day-Detected★ 0githubgithub.com/shndnth/CVE-2022-30190★ 0githubgithub.com/u1tr0nex/CVE-2022-30190-Follina-Lab★ 0githubgithub.com/kaleth4/CVE-2022-30190★ 0githubgithub.com/czabatta/THM-Tempest★ 0vulncheckvulncheck.com/xdb/39be3db1c3a9no verificadovulncheckvulncheck.com/xdb/3693ebb98cb1no verificadovulncheckvulncheck.com/xdb/2cf0c767549dno verificadovulncheckvulncheck.com/xdb/3f273c93bd7ano verificadovulncheckvulncheck.com/xdb/6d99fa39c86eno verificadovulncheckvulncheck.com/xdb/5dd783505e0cno verificadovulncheckvulncheck.com/xdb/1b8342efad20no verificadovulncheckvulncheck.com/xdb/48a2756591c7no verificadovulncheckvulncheck.com/xdb/c5f95b440666no verificadovulncheckvulncheck.com/xdb/23ec9e87f75cno verificadovulncheckvulncheck.com/xdb/eb69721d55b4no verificadovulncheckvulncheck.com/xdb/2825cac4d3fbno verificadovulncheckvulncheck.com/xdb/4485e26d21d7no verificadovulncheckvulncheck.com/xdb/649886ce0162no verificadovulncheckvulncheck.com/xdb/b8235d84dffdno verificadovulncheckvulncheck.com/xdb/ce6906543230no verificadovulncheckvulncheck.com/xdb/8b9f5c71e59cno verificadovulncheckvulncheck.com/xdb/a326514d07cbno verificadovulncheckvulncheck.com/xdb/85fd5fb25813no verificadovulncheckvulncheck.com/xdb/27f8c438cf29no verificadovulncheckvulncheck.com/xdb/fd7c95a5f90fno verificadovulncheckvulncheck.com/xdb/3aa02158ccc4no verificadovulncheckvulncheck.com/xdb/bc38656013e9no verificadovulncheckvulncheck.com/xdb/4fa26719340cno verificadovulncheckvulncheck.com/xdb/05001d61d2a9no verificadovulncheckvulncheck.com/xdb/15bf7cdea333no verificadovulncheckvulncheck.com/xdb/f87cc7447ce1no verificadovulncheckvulncheck.com/xdb/9e20f124a34ano verificadocve_referencepacketstormsecurity.com/files/167438/Microsoft-Office-Word-MSDTJS-Code-Execution.htmlno verificadovulncheckvulncheck.com/xdb/f09c047235a9no verificadovulncheckvulncheck.com/xdb/35f9914d3270no verificadovulncheckvulncheck.com/xdb/70970cd2ac26no verificadovulncheckvulncheck.com/xdb/b388e145f6cfno verificadovulncheckvulncheck.com/xdb/cdbdee6a1fd2no verificadovulncheckvulncheck.com/xdb/4b85eb5a132ano verificadovulncheckvulncheck.com/xdb/4fb550777afdno verificadovulncheckvulncheck.com/xdb/b4cb973319f6no verificadovulncheckvulncheck.com/xdb/c00e3fafa938no verificadovulncheckvulncheck.com/xdb/ee13d8c81cacno verificadovulncheckvulncheck.com/xdb/ce385fe1282fno verificadovulncheckvulncheck.com/xdb/e03a55c6cfd8no verificadovulncheckvulncheck.com/xdb/0fea368e9c74no verificadovulncheckvulncheck.com/xdb/3290d557edccno verificadovulncheckvulncheck.com/xdb/b1008fd7ec75no verificadovulncheckvulncheck.com/xdb/cee6be5b0aeeno verificadovulncheckvulncheck.com/xdb/82342a955e7bno verificadovulncheckvulncheck.com/xdb/c22411de313cno verificadovulncheckvulncheck.com/xdb/ec804773a346no verificadovulncheckvulncheck.com/xdb/bf72bf4f33b7no verificadovulncheckvulncheck.com/xdb/030dab3ef947no verificadovulncheckvulncheck.com/xdb/c184d82bd094no verificadovulncheckvulncheck.com/xdb/4b58657d25ddno verificado
⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.
CVEs relacionadas — Microsoft Windows 10 Version 1507

En el mismo producto, de las más peligrosas a las menos.

CVE-2021-34527HIGHWindows Print Spooler Remote Code Execution VulnerabilityEPSS 99.8%KEVCVE-2023-36884HIGHWindows Search Remote Code Execution VulnerabilityEPSS 99.4%KEVCVE-2024-21412HIGHInternet Shortcut Files Security Feature Bypass VulnerabilityEPSS 99.4%KEVCVE-2021-40444HIGHMicrosoft MSHTML Remote Code Execution VulnerabilityEPSS 97.8%KEVCVE-2023-36025HIGHWindows SmartScreen Security Feature Bypass VulnerabilityEPSS 88.2%KEVCVE-2025-33053HIGHInternet Shortcut Files Remote Code Execution VulnerabilityEPSS 87.1%KEV