PT-2022-5228 · Microsoft · Windows

Published 2022-10-22 · Updated 2022-10-22

Positive Technologies (AI Summary)

CVSS v2.0

10

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Windows (affected versions not specified)

Description The issue is related to a flaw in the Mark-of-the-Web (MoTW) mechanism of Windows operating systems, specifically concerning incorrect cryptographic signature verification. This could allow a remote attacker to bypass security mechanisms and execute arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Verification of Cryptographic Signature

RCE

Weakness Enumeration

CWE-347

CWE-20

Related Identifiers

BDU:2022-06491

Affected Products

Windows

References · 2

• https://bdu.fstec.ru/vul/2022-06491 · Security Note
• https://bleepingcomputer.com/news/security/exploited-windows-zero-day-lets-javascript-files-bypass-security-warnings · Note