Skip to content
OpenAdvisories
Critical MSRC-CVE-2022-37976 1 CVE

Active Directory Certificate Services Elevation of Privilege Vulnerability

Published Oct 11, 2022 · Updated Oct 18, 2022 · Revision 3

Vendor: Microsoft

Summary

Impact: Elevation of Privilege. Microsoft rating: Critical. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What privileges could be gained by an attacker who successfully exploited the vulnerability?
An attacker who successfully exploited this vulnerability could gain domain administrator privileges.

How could an attacker exploit this vulnerability?
A malicious DCOM client could coerce a DCOM server to authenticate to it through the Active Directory Certificate Service (ADCS), and use the credential to launch a cross-protocol attack.

Security updates
10.0.17763.3532 — https://support.microsoft.com/help/5018419
10.0.20348.1129 — https://support.microsoft.com/help/5018421
10.0.14393.5427 — https://support.microsoft.com/help/5018411
6.0.6003.21721 — https://support.microsoft.com/help/5018450
6.0.6003.21721 — https://support.microsoft.com/help/5018446
6.1.7601.26174 — https://support.microsoft.com/help/5018454
6.1.7601.26174 — https://support.microsoft.com/help/5018479
6.2.9200.23920 — https://support.microsoft.com/help/5018457
6.2.9200.23920 — https://support.microsoft.com/help/5018478
6.3.9600.20625 — https://support.microsoft.com/help/5018474
6.3.9600.20625 — https://support.microsoft.com/help/5018476

Vulnerabilities 1

Revision history

  1. #3

    Updated CVE Tag. This is an informational change only.

  2. #2

    Updated FAQ information. This is an informational change only.

  3. #1

    Information published.

References