CVE-2022-29109 - Vulnerability Details

Vendors	Products
Microsoft	365 Apps Office Office Online Server

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29109

Type	Values Removed	Values Added
CPEs	cpe:2.3:a:microsoft:365_apps:-::::enterprise::: cpe:2.3:a:microsoft:office:2019:::::::* cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::::*
Vendors & Products	Microsoft office Long Term Servicing Channel
References		https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109

Show plain JSON

{"containers": {"cna": {"title": "Microsoft Excel Remote Code Execution Vulnerability", "datePublic": "2022-05-10T08:00:00+00:00", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:*", "versionStartIncluding": "19.0.0", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "16.0.10386.20015"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}, {"vulnerable": true, "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:*:*:*:*:*:*:*:*", "versionStartIncluding": "16.0.1", "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Microsoft Office 2019", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "19.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office Online Server", "platforms": ["Unknown"], "versions": [{"version": "16.0.1", "lessThan": "16.0.10386.20015", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "platforms": ["x64-based Systems", "32-bit Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Excel Remote Code Execution Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-02T18:58:06.242Z"}, "references": [{"name": "Microsoft Excel Remote Code Execution Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.8, "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T06:10:59.089Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29109"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2022-29109", "datePublished": "2022-05-10T20:34:13", "dateReserved": "2022-04-12T00:00:00", "dateUpdated": "2025-01-02T18:58:06.242Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{

containers : { »

cna : { »

title : Microsoft Excel Remote Code Execution Vulnerability (string)

datePublic : 2022-05-10T08:00:00+00:00 (string)

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

operator : OR (string)

negate : false (boolean)

cpeMatch : [ »

0 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 19.0.0 (string)

versionEndExcluding : https://aka.ms/OfficeSecurityReleases (string)

}

1 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:office_online_server:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 16.0.1 (string)

versionEndExcluding : 16.0.10386.20015 (string)

}

2 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:* (string)

versionStartIncluding : 16.0.1 (string)

versionEndExcluding : https://aka.ms/OfficeSecurityReleases (string)

}

3 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:a:microsoft:office_long_term_servicing_channel:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 16.0.1 (string)

versionEndExcluding : https://aka.ms/OfficeSecurityReleases (string)

}

]

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Microsoft Office 2019 (string)

platforms : [ »

0 : 32-bit Systems (string)

1 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 19.0.0 (string)

lessThan : https://aka.ms/OfficeSecurityReleases (string)

versionType : custom (string)

status : affected (string)

}

]

}

1 : { »

vendor : Microsoft (string)

product : Microsoft Office Online Server (string)

platforms : [ »

0 : Unknown (string)

]

versions : [ »

0 : { »

version : 16.0.1 (string)

lessThan : 16.0.10386.20015 (string)

versionType : custom (string)

status : affected (string)

}

]

}

2 : { »

vendor : Microsoft (string)

product : Microsoft 365 Apps for Enterprise (string)

platforms : [ »

0 : 32-bit Systems (string)

1 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 16.0.1 (string)

lessThan : https://aka.ms/OfficeSecurityReleases (string)

versionType : custom (string)

status : affected (string)

}

]

}

3 : { »

vendor : Microsoft (string)

product : Microsoft Office LTSC 2021 (string)

platforms : [ »

0 : x64-based Systems (string)

1 : 32-bit Systems (string)

]

versions : [ »

0 : { »

version : 16.0.1 (string)

lessThan : https://aka.ms/OfficeSecurityReleases (string)

versionType : custom (string)

status : affected (string)

}

]

}

]

descriptions : [ »

0 : { »

value : Microsoft Excel Remote Code Execution Vulnerability (string)

lang : en-US (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Remote Code Execution (string)

lang : en-US (string)

type : Impact (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2025-01-02T18:58:06.242Z (string)

}

references : [ »

0 : { »

name : Microsoft Excel Remote Code Execution Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109 (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

cvssV3_1 : { »

version : 3.1 (string)

baseSeverity : HIGH (string)

baseScore : 7.8 (number)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T06:10:59.089Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

tags : [ »

0 : x_refsource_MISC (string)

1 : x_transferred (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29109 (string)

}

]

}

]

}

cveMetadata : { »

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

assignerShortName : microsoft (string)

cveId : CVE-2022-29109 (string)

datePublished : 2022-05-10T20:34:13 (string)

dateReserved : 2022-04-12T00:00:00 (string)

dateUpdated : 2025-01-02T18:58:06.242Z (string)

state : PUBLISHED (string)

}

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*", "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*", "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:x64:*", "matchCriteriaId": "68F37A38-9BC3-43FD-8E71-4EED079156D4", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:x86:*", "matchCriteriaId": "AFFA09D5-9992-462F-B52E-A1DDE2462064", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2021:*:*:*:ltsc:*:x64:*", "matchCriteriaId": "1AC0C23F-FC55-4DA1-8527-EB4432038FB0", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2021:*:*:*:ltsc:*:x86:*", "matchCriteriaId": "A719B461-7869-46D0-9300-D0A348DC26A5", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:*", "matchCriteriaId": "E98AE986-FA31-4301-8025-E8915BA4AC5E", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft Excel Remote Code Execution Vulnerability"}, {"lang": "es", "value": "Una vulnerabilidad de Ejecuci\u00f3n de C\u00f3digo Remota en Microsoft Excel. Este ID de CVE es diferente de CVE-2022-29110"}], "id": "CVE-2022-29109", "lastModified": "2025-01-02T19:16:08.220", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Secondary"}]}, "published": "2022-05-10T21:15:11.507", "references": [{"source": "secure@microsoft.com", "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29109"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:* (string)

matchCriteriaId : 3259EBFE-AE2D-48B8-BE9A-E22BBDB31378 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:* (string)

matchCriteriaId : CD25F492-9272-4836-832C-8439EBE64CCF (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:x64:* (string)

matchCriteriaId : 68F37A38-9BC3-43FD-8E71-4EED079156D4 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:x86:* (string)

matchCriteriaId : AFFA09D5-9992-462F-B52E-A1DDE2462064 (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:a:microsoft:office:2021:*:*:*:ltsc:*:x64:* (string)

matchCriteriaId : 1AC0C23F-FC55-4DA1-8527-EB4432038FB0 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:a:microsoft:office:2021:*:*:*:ltsc:*:x86:* (string)

matchCriteriaId : A719B461-7869-46D0-9300-D0A348DC26A5 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:a:microsoft:office_online_server:-:*:*:*:*:*:*:* (string)

matchCriteriaId : E98AE986-FA31-4301-8025-E8915BA4AC5E (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Microsoft Excel Remote Code Execution Vulnerability (string)

}

1 : { »

lang : es (string)

value : Una vulnerabilidad de Ejecución de Código Remota en Microsoft Excel. Este ID de CVE es diferente de CVE-2022-29110 (string)

}

]

id : CVE-2022-29109 (string)

lastModified : 2025-01-02T19:16:08.220 (string)

metrics : { »

cvssMetricV2 : [ »

0 : { »

acInsufInfo : false (boolean)

baseSeverity : MEDIUM (string)

cvssData : { »

accessComplexity : MEDIUM (string)

accessVector : NETWORK (string)

authentication : NONE (string)

availabilityImpact : PARTIAL (string)

baseScore : 6.8 (number)

confidentialityImpact : PARTIAL (string)

integrityImpact : PARTIAL (string)

vectorString : AV:N/AC:M/Au:N/C:P/I:P/A:P (string)

version : 2.0 (string)

}

exploitabilityScore : 8.6 (number)

impactScore : 6.4 (number)

obtainAllPrivilege : false (boolean)

obtainOtherPrivilege : false (boolean)

obtainUserPrivilege : false (boolean)

source : nvd@nist.gov (string)

type : Primary (string)

userInteractionRequired : true (boolean)

}

]

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : secure@microsoft.com (string)

type : Secondary (string)

}

1 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : LOCAL (string)

availabilityImpact : HIGH (string)

baseScore : 7.8 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : NONE (string)

scope : UNCHANGED (string)

userInteraction : REQUIRED (string)

vectorString : CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.8 (number)

impactScore : 5.9 (number)

source : nvd@nist.gov (string)

type : Secondary (string)

}

]

}

published : 2022-05-10T21:15:11.507 (string)

references : [ »

0 : { »

source : secure@microsoft.com (string)

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-29109 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-29109 (string)

}

]

sourceIdentifier : secure@microsoft.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

Metrics

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object