Microsoft Word Remote Code Execution Vulnerability

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability in Microsoft Word. (CVE-2022-41061)   
  - A remote code execution vulnerability in Microsoft Office Graphics. (CVE-2022-41107)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version   number.

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing a language pack security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41062)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41103)

The Microsoft Word Products are missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A remote code execution vulnerability. (CVE-2022-41061)

  - Two information disclosure vulnerabilities. (CVE-2022-41060, CVE-2022-41103)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft SharePoint Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41062)

The Microsoft SharePoint Server Subscription Edition installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41062)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41103)

The Microsoft SharePoint Server 2016 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41062)

The Microsoft SharePoint Server 2013 installation installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061)

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41063, CVE-2022-41106)

The Microsoft Word Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061)

  - An information disclosure vulnerability. An attacker can exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

ID	Name	Product	Family	Severity
168913	Security Updates for Microsoft Office Products (Nov 2022) (macOS)	Nessus	MacOS X Local Security Checks	high
168503	Security Updates for Microsoft SharePoint Server Subscription Edition Language Pack (November 2022)	Nessus	Windows : Microsoft Bulletins	high
168222	Security Updates for Microsoft Word Products C2R (November 2022)	Nessus	Windows	high
167268	Security Updates for Microsoft SharePoint Server 2019 (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167267	Security Updates for Microsoft SharePoint Server Subscription Edition (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167266	Security Updates for Microsoft SharePoint Server 2016 (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167265	Security Updates for Microsoft SharePoint Server 2013 (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167114	Security Updates for Microsoft Office Web Apps (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167110	Security Updates for Microsoft Word Products (November 2022)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2022-41061

high

Tenable Plugins

high

high

high

high

high

high

high

high

high