7.8

CVE-2023-21726

Windows Credential Manager User Interface Elevation of Privilege Vulnerability

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Windows 10 1607 Version- HwPlatformx64
Microsoft ≫ Windows 10 1607 Version- HwPlatformx86
Microsoft ≫ Windows 10 1809 Version- HwPlatformarm64
Microsoft ≫ Windows 10 1809 Version- HwPlatformx64
Microsoft ≫ Windows 10 1809 Version- HwPlatformx86
Microsoft ≫ Windows 10 20h2 Version- HwPlatformarm64
Microsoft ≫ Windows 10 20h2 Version- HwPlatformx64
Microsoft ≫ Windows 10 20h2 Version- HwPlatformx86
Microsoft ≫ Windows 10 21h2 Version- HwPlatformarm64
Microsoft ≫ Windows 10 21h2 Version- HwPlatformx64
Microsoft ≫ Windows 10 21h2 Version- HwPlatformx86
Microsoft ≫ Windows 10 22h2 Version- HwPlatformarm64
Microsoft ≫ Windows 10 22h2 Version- HwPlatformx64
Microsoft ≫ Windows 10 22h2 Version- HwPlatformx86
Microsoft ≫ Windows 11 21h2 Version- HwPlatformarm64
Microsoft ≫ Windows 11 21h2 Version- HwPlatformx64
Microsoft ≫ Windows 11 22h2 Version- HwPlatformarm64
Microsoft ≫ Windows 11 22h2 Version- HwPlatformx64
Microsoft ≫ Windows 7 Version- Updatesp1 HwPlatformx64
Microsoft ≫ Windows 7 Version- Updatesp1 HwPlatformx86
Microsoft ≫ Windows 8.1 Version- HwPlatformx64
Microsoft ≫ Windows 8.1 Version- HwPlatformx86
Microsoft ≫ Windows Rt 8.1 Version-
Microsoft ≫ Windows Server 2008 Version- Updatesp2 HwPlatformx64
Microsoft ≫ Windows Server 2008 Version- Updatesp2 HwPlatformx86
Microsoft ≫ Windows Server 2008 Versionr2 Updatesp1 HwPlatformx64
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 0.1% 0.278
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
secure@microsoft.com 7.8 1.8 5.9
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
CWE-257 Storing Passwords in a Recoverable Format

The storage of passwords in a recoverable format makes them subject to password reuse attacks by malicious users. In fact, it should be noted that recoverable encrypted passwords provide no significant benefit over plaintext passwords since they are subject not only to reuse by malicious attackers but also by malicious insiders. If a system administrator can recover a password directly, or use a brute force search on the available information, the administrator can use the password on other accounts.