Microsoft Excel Remote Code Execution Vulnerability

The Microsoft Excel Products are missing a security update. It is, therefore, affected by the following vulnerabilities:

  - A security feature bypass vulnerability. (CVE-2022-41104)

  - Two remote code execution vulnerabilities. (CVE-2022-41106, CVE-2022-41063)

Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2022-41060, CVE-2022-41103)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41061,     CVE-2022-41063, CVE-2022-41106)

The Microsoft Excel Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising the integrity of the system/application.
    (CVE-2022-41104)

  - A remote code execution vulnerability. An attacker can exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2022-41063, CVE-2022-41106)

ID	Name	Product	Family	Severity
168223	Security Updates for Microsoft Excel Products C2R (November 2022)	Nessus	Windows	high
167114	Security Updates for Microsoft Office Web Apps (November 2022)	Nessus	Windows : Microsoft Bulletins	high
167108	Security Updates for Microsoft Excel Products (November 2022)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2022-41063

high

Tenable Plugins

high

high

high