Windows 10: Exchange CU13 and latest SU, yet external scans claim CVE-2022-41040 CVE-2022-41082...

Per Exchange Health Checker version 24.03.12.1700 this is my Exchange version. Build Number: 15.02.1258.032 Exchange IU or Security Hotfix Detected:Security Update for Exchange Server 2019 Cumulative Update 13 KB5036402We always run one CU behind the latest, and we pay for external vulnerability scans. So when CU12 went end of life we upgraded to CU13, and then our SOC began telling us that our Microsoft Exchange Server OWA has KB5019758, ProxyNotShell CVE-2022-41040: Server-Side Request Forgery SSRF and CVE-2022-41082: Remote code execution RCE vulnerabilities.So I do my own e

:)

 

Was Follina (CVE-2022-30190) not actually addressed in the June 2022 Security Patch?

Hello,

I have an issue with the flow of information when using the MSRC Portal, as the Follina CVE (CVE-2022-30190) is not showing as part of the CVE's addressed in the June 2022 patch, even though it does say that the June 2022 Security Patch fixes the Vulnerability.

Please follow my steps:

MSRC's Follina CVE page Security Update Guide - Microsoft Security Response Center

Navigate to the bottom and select the KB Article for Server 2019 (this applies to all other KB Articles, but this is my example)

https://support.microsoft.com/en-gb...763-3046-62fe56c1-a8c0-40e8-a901-677ab9538bf8

In this article, follow the link under Improvements -> "June 2022 Security Updates."

This brings you back to the MSRC page: Security Update Guide - Microsoft Security Response Center

These release notes DO NOT say that the CVE-2022-30190 was addressed in the June patching...?

Can someone please help here and confirm if the Follina CVE (CVE-2022-30190) patch was actually applied in the June Patch Tuesday release?

 

CVE-2022-30190 workaround for Windows 7

That's your guide from Microsoft:

Guidance for CVE-2022-30190 Microsoft Support Diagnostic Tool Vulnerability

On Monday May 30, 2022, Microsoft issued CVE-2022-30190 regarding the Microsoft Support Diagnostic Tool (MSDT) in Windows vulnerability

/blog/2022/05/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

 

CVE-2022-30190 workaround for Windows 7

The guidance for CVE-2022-30190 mentions deleting the MSDT URL Protocol as a workaround for this vulnerability.

/blog/2022/05/guidance-for-cve-2022-30190-microsoft-support-diagnostic-tool-vulnerability/

However, the FAQ says "The registry key mentioned in the workaround section will not exist in earlier supported versions of Windows, so the workaround is not required."

Does this mean there is no workaround for Windows 7 and the only solution is to install the July 2022 security update?