Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker could bypass the Kerberos service ticketing feature which performs user access control checks.
How could an attacker exploit this vulnerability?
An low privilege attacker could execute a script within an App Container to request a service ticket and thereby gain elevation to the service privilege.
Security updates
10.0.17763.3046 — https://support.microsoft.com/help/5014692
10.0.19043.1766 — https://support.microsoft.com/help/5014699
10.0.20348.770 — https://support.microsoft.com/help/5014678
10.0.20348.770 — https://support.microsoft.com/help/5014677
10.0.22000.739 — https://support.microsoft.com/help/5014697
10.0.10240.19325 — https://support.microsoft.com/help/5014710
10.0.14393.5192 — https://support.microsoft.com/help/5014702
6.3.9600.20402 — https://support.microsoft.com/help/5014738
6.3.9600.20402 — https://support.microsoft.com/help/5014746
6.2.9200.23736 — https://support.microsoft.com/help/5014747
6.2.9200.23736 — https://support.microsoft.com/help/5014741
Vulnerabilities 1
-
High 7.8
Kerberos AppContainer Security Feature Bypass Vulnerability
Kerberos AppContainer Security Feature Bypass Vulnerability
Revision history
-
#2
Updated one or more CVSS scores for the affected products. This is an informational change only.
-
#1
Information published.
References
-
CVE-2022-30164 Kerberos AppContainer Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-30164
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss