Main
Vulnerability Database
Exploits
ID:10648 - Exploit for Buffer overflow in Microsoft products - CVE-2022-21907
ID:10648 - Exploit for Buffer overflow in Microsoft products - CVE-2022-21907
Published: October 25, 2024
Vulnerability identifier: #VU59392
Vulnerability risk: Critical
CVE-ID: CVE-2022-21907
CWE-ID: CWE-119
Exploitation vector: Remote access
Vulnerable software:
Windows
Windows Server
Microsoft Internet Information Services (IIS)
Windows
Windows Server
Microsoft Internet Information Services (IIS)
Link to public exploit:
Vulnerability description
The vulnerability allows a remote attacker to execute arbitrary code on the target system.
The vulnerability exists due to a boundary error within the HTTP Trailer Support feature in HTTP Protocol Stack (http.sys). A remote attacker can send a specially crafted HTTP request to the web server, trigger a buffer overflow and execute arbitrary code on the system.
Remediation
Install updates from vendor's website.