PT-2022-1813 · Microsoft · Edge

David Erceg · Published 2022-01-06 · Updated 2024-11-14 · CVE-2022-21970

Positive Technologies (AI Summary)

CVSS v2.0

8.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:P/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Edge (Chromium-based) (affected versions not specified)

Description The issue is related to insufficient access controls in Microsoft Edge, allowing a remote attacker to elevate privileges in the system. This can enable the execution of JavaScript code on every host without permission, theft of local system files, manipulation of actions against the machine, and alteration of internal developer settings in Microsoft Edge.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2022-01243

CVE-2022-21970

Affected Products

Edge

References · 11

• 🔥 https://github.com/nu11secur1ty/Windows10Exploits/tree/master/2022/CVE-2022-21970 · Exploit
• 🔥 https://github.com/Malwareman007/CVE-2022-21970 · Exploit
• https://osv.dev/vulnerability/CVE-2022-21970 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21970 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01243 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2022-21970 · Security Note
• https://t.me/cvenotify/25258 · Telegram Post
• https://t.me/freedomf0x/18008 · Telegram Post
• https://t.me/cybersecuritytechnologies/7034 · Telegram Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21970 · Note
• https://t.me/cibsecurity/35294 · Telegram Post