8.1

CVE-2022-26925

Warnung

Windows LSA Spoofing Vulnerability

Daten sind bereitgestellt durch National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1507 Version < 10.0.10240.19297
Microsoft ≫ Windows 10 1607 Version < 10.0.14393.5125
Microsoft ≫ Windows 10 1809 Version < 10.0.17763.2928
Microsoft ≫ Windows 10 1909 Version < 10.0.18363.2274
Microsoft ≫ Windows 10 20h2 Version < 10.0.19042.1706
Microsoft ≫ Windows 10 21h1 Version < 10.0.19043.1706
Microsoft ≫ Windows 10 21h2 Version < 10.0.19044.1706
Microsoft ≫ Windows 11 21h2 Version < 10.0.22000.675
Microsoft ≫ Windows 7 Version- Updatesp1
Microsoft ≫ Windows 8.1 Version-
Microsoft ≫ Windows Rt 8.1 Version-
Microsoft ≫ Windows Server 2008 Version- Updatesp2
Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
Microsoft ≫ Windows Server 2016 Version < 10.0.14393.5125
Microsoft ≫ Windows Server 2019 Version < 10.0.17763.2928
Microsoft ≫ Windows Server 2022 Version < 10.0.20348.707
Microsoft ≫ Windows Server 20h2 Version < 10.0.19042.1706

01.07.2022: CISA Known Exploited Vulnerabilities (KEV) Catalog

Microsoft Windows LSA Spoofing Vulnerability

Schwachstelle

Microsoft Windows Local Security Authority (LSA) contains a spoofing vulnerability where an attacker can coerce the domain controller to authenticate to the attacker using NTLM.

Beschreibung

Apply remediation actions outlined in CISA guidance [https://www.cisa.gov/guidance-applying-june-microsoft-patch].

Erforderliche Maßnahmen
EPSS Metriken
Typ Quelle Score Percentile
EPSS FIRST.org 28.91% 0.964
CVSS Metriken
Quelle Base Score Exploit Score Impact Score Vector String
nvd@nist.gov 5.9 2.2 3.6
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:H/A:N
nvd@nist.gov 4.3 8.6 2.9
AV:N/AC:M/Au:N/C:N/I:P/A:N
secure@microsoft.com 8.1 2.2 5.9
CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H
CWE-306 Missing Authentication for Critical Function

The product does not perform any authentication for functionality that requires a provable user identity or consumes a significant amount of resources.