CVE-2022-44875

Summary

KioWare through 8.33 on Windows sets KioScriptingUrlACL.AclActions.AllowHigh for the about:blank origin, which allows attackers to obtain SYSTEM access via KioUtils.Execute in JavaScript code.

Affected Software

Weaknesses

• n/a

ADP Enrichment

CVE Program Container

Additional References

• https://www.kioware.com/versionhistory.aspx?pid=15
• https://github.com/olnor18/writeup/tree/master/CVE/CVE-2022-44875

CISA ADP Vulnrichment

• SSVC:
• Exploitation: poc
  • Automatable: no
  • Technical Impact: partial

References

• https://www.kioware.com/versionhistory.aspx?pid=15
• https://github.com/olnor18/writeup/tree/master/CVE/CVE-2022-44875

• ←Previous
• Next→