CVE-2021-36942

Warnung

Exploit

EPSS 66.02%
Veröffentlicht 12.08.2021 18:15:10
Zuletzt bearbeitet 10.08.2026 20:19:03
Erkennungen
Login

Windows LSA Spoofing Vulnerability

Windows LSA Spoofing Vulnerability

Betroffene Produkte Warnungen 1 Metriken 4 CWE 0 Referenzen 7

NVD 8 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ Windows Server 2004 Version < 10.0.19041.1165

Microsoft ≫ Windows Server 2008 Version - Update sp2

Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform x64

Microsoft ≫ Windows Server 2012 Version -

Microsoft ≫ Windows Server 2012 Version r2

Microsoft ≫ Windows Server 2016 Version < 10.0.14393.4583

Microsoft ≫ Windows Server 2019 Version < 10.0.17763.2114

Microsoft ≫ Windows Server 20h2 Version < 10.0.19042.1165

03.11.2021: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows Local Security Authority (LSA) Spoofing Vulnerability

Schwachstelle

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability allowing an unauthenticated attacker to call a method on the LSARPC interface and coerce the domain controller to authenticate against another server using NTLM.

Beschreibung

Apply updates per vendor instructions.

Erforderliche Maßnahmen

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	66.02%	0.992

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	5	10	2.9	AV:N/AC:L/Au:N/C:N/I:P/A:N
NIST	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:H/A:N
Microsoft	7.5	3.9	3.6	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N