CVE-2022-25943

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

The installer of WPS Office for Windows versions prior to v11.2.0.10258 fails to configure properly the ACL for the directory where the service program is installed.

Metrics

CVSS 3.1 7.8/10CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-276

Affected software

Vendor	Product	Versions
WPS Office Software	WPS Office for Windows	versions prior to v11.2.0.10258

References

https://github.com/HadiMed/KINGSOFT-WPS-Office-LPEExploit, Third Party Advisory
https://jvn.jp/en/vu/JVNVU90673830/Third Party Advisory
https://www.wps.com/whatsnew/pc/20210806/Product
https://github.com/HadiMed/KINGSOFT-WPS-Office-LPEExploit, Third Party Advisory
https://jvn.jp/en/vu/JVNVU90673830/Third Party Advisory
https://www.wps.com/whatsnew/pc/20210806/Product

Timeline

Published: Mar 9, 2022
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2022

CVE-2022-259466.5On all versions of 16.1.x, 15.1.x, 14.1.x, 13.1.x, 12.1.x, and 11.6.x of F5 BIG-IP Advanced WAF, ASM, and ASM, and F5 BIG-IP Guided Configur CVE-2022-259485.3The package liquidjs before 10.0.0 are vulnerable to Information Exposure when ownPropertyOnly parameter is set to False, which results in l CVE-2022-259497.8The kernel mode driver kwatch3 of KINGSOFT Internet Security 9 Plus Version 2010.06.23.247 fails to properly handle crafted inputs, leading CVE-2022-259510.0Improper Authorization in GitHub repository kromitgmbh/titra prior to 0.79.1.CVE-2022-259528.8Cross-Site Request Forgery (CSRF) vulnerability in Keywordrush Content Egg plugin <= 5.4.0 on WordPress.CVE-2022-259597.8Omron CX-Position (versions 2.5.3 and prior) is vulnerable to memory corruption while processing a specific project file, which may allow an CVE-2022-25965.9Inefficient Regular Expression Complexity in GitHub repository node-fetch/node-fetch prior to 3.2.10.CVE-2022-259629.8All versions of the package vagrant.js are vulnerable to Command Injection via the boxAdd function due to improper input sanitization.CVE-2022-259667.8Improper access control in the Intel(R) Edge Insights for Industrial software before version 2.6.1 may allow an authenticated user to potent CVE-2022-259678.8Versions of the package eta before 2.0.0 are vulnerable to Remote Code Execution (RCE) by overwriting template engine configuration variable CVE-2022-259697.8The installer of WPS Office Version 10.8.0.6186 insecurely load VERSION.DLL (or some other DLLs), allowing an attacker to execute arbitrary CVE-2022-25975.4The Visual Portfolio, Photo Gallery & Post Grid WordPress plugin before 2.19.0 does not have proper authorisation checks in some of its REST