CVE-2022-26081

The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer.

CVSS v3 7.8 HIGH
CVSS v2.0 6.8 MEDIUM

7.8^/10

CVSS v3 : HIGH

Vector :

Exploitability : 1.8 / Impact : 5.9

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact HIGH

Availability Impact HIGH

Scope UNCHANGED

6.8^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability : 8.6 / Impact : 6.4

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

References

Link	Resource
https://jvn.jp/en/jp/JVN21234459/	Third Party Advisory
https://support.kingsoft.jp/support-info/weakness.html	Vendor Advisory

Configurations

Configuration 1 (hide)

cpe:2.3:a:kingsoft:wps_office:10.8.0.5745:*:*:*:*:*:*:*

History

24 Mar 2022, 15:03

Type	Values Removed	Values Added
CPE		cpe:2.3:a:kingsoft:wps_office:10.8.0.5745:::::::*
References	~~(CONFIRM) https://support.kingsoft.jp/support-info/weakness.html -~~	(CONFIRM) https://support.kingsoft.jp/support-info/weakness.html - Vendor Advisory
References	~~(JVN) https://jvn.jp/en/jp/JVN21234459/ -~~	(JVN) https://jvn.jp/en/jp/JVN21234459/ - Third Party Advisory
First Time		Kingsoft wps Office Kingsoft
CVSS	v2 : ~~unknown~~ v3 : ~~unknown~~	v2 : 6.8 v3 : 7.8
CWE		CWE-427

17 Mar 2022, 18:26

Type	Values Removed	Values Added
New CVE

Information

Published : 2022-03-17 18:15

Updated : 2023-12-10 14:22

NVD link : CVE-2022-26081

Mitre link : CVE-2022-26081

CVE.ORG link : CVE-2022-26081

JSON object : View

Products Affected

kingsoft

wps_office

CWE

CWE-427

Uncontrolled Search Path Element

{"id": "CVE-2022-26081", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV31": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 5.9, "exploitabilityScore": 1.8}]}, "published": "2022-03-17T18:15:09.153", "references": [{"url": "https://jvn.jp/en/jp/JVN21234459/", "tags": ["Third Party Advisory"], "source": "vultures@jpcert.or.jp"}, {"url": "https://support.kingsoft.jp/support-info/weakness.html", "tags": ["Vendor Advisory"], "source": "vultures@jpcert.or.jp"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-427"}]}, {"type": "Secondary", "source": "vultures@jpcert.or.jp", "description": [{"lang": "en", "value": "CWE-427"}]}], "descriptions": [{"lang": "en", "value": "The installer of WPS Office Version 10.8.0.5745 insecurely load shcore.dll, allowing an attacker to execute arbitrary code with the privilege of the user invoking the installer."}, {"lang": "es", "value": "El instalador de WPS Office versi\u00f3n 10.8.0.5745, carga de forma no segura de shcore.dll, lo que permite a un atacante ejecutar c\u00f3digo arbitrario con el privilegio del usuario invocando a el instalador"}], "lastModified": "2022-03-24T15:03:15.340", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:kingsoft:wps_office:10.8.0.5745:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "38F3FA31-04D8-4D5A-B2D1-2FB4F96FBA26"}], "operator": "OR"}]}], "sourceIdentifier": "vultures@jpcert.or.jp"}