CVE-2017-0022

CVE-2017-0022 is a medium-severity (CVSS 6.5) vulnerability in Microsoft XML Core Services. CISA added it to the Known Exploited Vulnerabilities catalog on May 24, 2022, which means exploitation in the wild has been confirmed; US federal agencies had to remediate it by June 14, 2022. CISA does not currently list it as used in ransomware campaigns. Microsoft has 390 vulnerabilities in the KEV catalog, 117 of them linked to ransomware.

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."

CVSS vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

• http://www.securityfocus.com/bid/96069
• http://www.securitytracker.com/id/1038014
• https://0patch.blogspot.com/2017/09/exploit-kit-rendezvous-and-cve-2017-0022.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0022
• http://www.securityfocus.com/bid/96069
• http://www.securitytracker.com/id/1038014
• https://0patch.blogspot.com/2017/09/exploit-kit-rendezvous-and-cve-2017-0022.html
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0022