Microsoft Word Information Disclosure Vulnerability

The Microsoft Word Products are missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability. (CVE-2022-41061)

  - Two information disclosure vulnerabilities. (CVE-2022-41060, CVE-2022-41103)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41062)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41062)

The Microsoft SharePoint Server 2013 installation installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41063, CVE-2022-41106)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061)

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

ID	Name	Product	Family	Severity
168222	Security Updates for Microsoft Word Products C2R (November 2022)	Nessus	Windows	high
167268	Security Updates for Microsoft SharePoint Server 2019 (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167266	Security Updates for Microsoft SharePoint Server 2016 (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167265	Security Updates for Microsoft SharePoint Server 2013 (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167114	Security Updates for Microsoft Office Web Apps (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167110	Security Updates for Microsoft Word Products (November 2022)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2022-41060

medium

Tenable Plugins

high

high

high

high

high

high