NVD - CVE-2022-21999 (original) (raw)

Metrics

NVD enrichment efforts reference publicly available information to associate vector strings. CVSS information contributed by other sources is also displayed.

CVSS 4.0 Severity and Vector Strings:

NIST CVSS score

NIST: NVD

NVD assessment not yet provided.

CVSS 3.x Severity and Vector Strings:

Nist CVSS score does not match with CNA score

CNA: Microsoft Corporation

Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

CVSS 2.0 Severity and Vector Strings:

National Institute of Standards and Technology

NIST: NVD

Vector: (AV:L/AC:L/Au:N/C:P/I:P/A:P)

References to Advisories, Solutions, and Tools

By selecting these links, you will be leaving NIST webspace. We have provided these links to other web sites because they may have information that would be of interest to you. No inferences should be drawn on account of other sites being referenced, or not, from this page. There may be other web sites that are more appropriate for your purpose. NIST does not necessarily endorse the views expressed, or concur with the facts presented on these sites. Further, NIST does not endorse any commercial products that may be mentioned on these sites. Please address comments about this page to [email protected].

URL Source(s) Tag(s)
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999 CVE, Microsoft Corporation Patch Vendor Advisory
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2022-21999 CISA-ADP US Government Resource

This CVE is in CISA's Known Exploited Vulnerabilities Catalog

Reference CISA's BOD 22-01 and Known Exploited Vulnerabilities Catalog for further guidance and requirements.

Vulnerability Name Date Added Due Date Required Action
Microsoft Windows Print Spooler Privilege Escalation Vulnerability 03/25/2022 04/15/2022 Apply updates per vendor instructions.

Known Affected Software Configurations Switch to CPE 2.2

Change History

14 change records found show changes

Modified Analysis by NIST 10/30/2025 3🔞50 PM

Action Type Old Value New Value
Added Reference Type CISA-ADP: https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2022-21999 Types: US Government Resource

CVE Modified by CISA-ADP 10/21/2025 8:17:53 PM

Action Type Old Value New Value
Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2022-21999

CVE Modified by CISA-ADP 10/21/2025 4🔞55 PM

Action Type Old Value New Value
Removed Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2022-21999

CVE Modified by CISA-ADP 10/21/2025 3:19:31 PM

Action Type Old Value New Value
Added Reference https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field\_cve=CVE-2022-21999

Modified Analysis by NIST 2/24/2025 10:49:00 AM

Action Type Old Value New Value

CVE Modified by CISA-ADP 1/29/2025 4:15:12 PM

Action Type Old Value New Value
Added CWE CWE-22
Added CWE CWE-59

CVE Modified by CVE 11/21/2024 1:45:51 AM

Action Type Old Value New Value
Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999

Modified Analysis by NIST 7/16/2024 1:47:26 PM

Action Type Old Value New Value
Changed CPE Configuration Record truncated, showing 2048 of 2069 characters. View Entire Change Record OR *cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server:2022:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server OR *cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.10240.19204 *cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.4946 *cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.2565 *cpe:2.3:o:microsoft:windows_10_1909:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.18363.2094 *cpe:2.3:o:microsoft:windows_10_20h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19042.1526 *cpe:2.3:o:microsoft:windows_10_21h1:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19043.1526 *cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19044.1526 *cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.22000.493 *cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.14393.4946 *cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.17763.2565 *cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.20348.524 *cpe:2.3:o:microsoft:windows_server_20h2:*:*:*:*:*:*:*:* versions up to (excluding) 10.0.19042.1526
Changed Reference Type https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999 No Types Assigned https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999 Patch, Vendor Advisory

CVE Modified by Microsoft Corporation 5/14/2024 6:12:09 AM

Action Type Old Value New Value

CWE Remap by NIST 8/08/2023 10:22:24 AM

Action Type Old Value New Value
Changed CWE CWE-269 CWE-22 CWE-59

CVE Modified by Microsoft Corporation 6/29/2023 1:15:11 AM

Action Type Old Value New Value
Changed Description Windows Print Spooler Elevation of Privilege Vulnerability. This CVE ID is unique from CVE-2022-21997, CVE-2022-22717, CVE-2022-22718. Windows Print Spooler Elevation of Privilege Vulnerability
Added Reference https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-21999 [No Types Assigned]
Removed Reference http://packetstormsecurity.com/files/166344/Windows-SpoolFool-Privilege-Escalation.html [Exploit, Third Party Advisory, VDB Entry]
Removed Reference https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21999 [Patch, Vendor Advisory]

Modified Analysis by NIST 5/26/2022 4:30:49 PM

Action Type Old Value New Value
Changed Reference Type http://packetstormsecurity.com/files/166344/Windows-SpoolFool-Privilege-Escalation.html No Types Assigned http://packetstormsecurity.com/files/166344/Windows-SpoolFool-Privilege-Escalation.html Exploit, Third Party Advisory, VDB Entry

CVE Modified by Microsoft Corporation 3/16/2022 3:15:08 PM

Action Type Old Value New Value
Added Reference http://packetstormsecurity.com/files/166344/Windows-SpoolFool-Privilege-Escalation.html [No Types Assigned]

Initial Analysis by NIST 2/14/2022 1:15:05 PM

Action Type Old Value New Value
Added CVSS V2 NIST (AV:L/AC:L/Au:N/C:P/I:P/A:P)
Added CWE NIST CWE-269
Added CPE Configuration Record truncated, showing 2048 of 2069 characters. View Entire Change Record OR *cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:20h2:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:21h1:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:21h2:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:1809:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_10:1909:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:arm64:* *cpe:2.3:o:microsoft:windows_11:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_7:sp1:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server:20h2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server:2022:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:* *cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* *cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* *cpe:2.3:o:microsoft:windows_server
Changed Reference Type https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21999 No Types Assigned https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-21999 Patch, Vendor Advisory