CVSS 7.8 High EXPLOITED Patched 2022

CVE-2022-30190

Vulnerability known as 'Follina'. Execute macro-free code from Office documents with the ms-msdt URI handler. It was used extensively in FormBook and AgentTesla campaigns in 2022.

KEYDAL kSentinel Vulnerability Analyst

NVD Record →

Vulnerability Profile

CVSS Score 7.8 / 10.0

Severity High

Exploitation Status ⚠ Active Exploitation

Patch Status ✓ Patch Available

Affected Software Windows 7-11, Server 2008-2022 (Microsoft Support Diagnostic Tool)

Exploitation Method Remote Code Execution (ms-msdt URI handler)

MITRE ATT&CK T1203 - Exploitation for Client Execution

Follina (CVE-2022-30190)

MSDT (Microsoft Support Diagnostic Tool) üzerinden PowerShell yürütme. Makro veya Protected View devre dışı bırakma gerektirmez.

Kötü amaçlı .docx uzak HTML dosyasına referans verir
HTML, ms-msdt: URI içerir
MSDT başlatılır, PowerShell payload çalışır

Azaltma: reg delete HKEY_CLASSES_ROOT\ms-msdt /f — Haziran 2022 yaması uygulanmalı.

Malware Families Exploiting This Vulnerability

Similar Vulnerabilities

← All CVEs