Skip to content
OpenAdvisories
High MSRC-CVE-2023-36021 1 CVE

Microsoft On-Prem Data Gateway Security Feature Bypass Vulnerability

Published Nov 14, 2023 · Updated Nov 14, 2023

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass certificate validation mechanisms and provide arbitrary certificates that do not have proper signatures.

According to the CVSS metric, the attack vector is network (AV:N), privilege required is low (PR:L) and user interaction is required (UI:R). How could an attacker exploit this security feature bypass vulnerability?
A security feature bypass vulnerability exists when On-Prem Data Gateway does not perform certificate validation logic correctly and impacts the reliability of the backend infrastructure's workflow. An authenticated attacker with normal user privileges, via network connection or web request, could provide the workflow with an arbitrary untrusted certificate, with an arbitrary common name, which does not have proper signature.

Security updates
3000.198.9 — https://learn.microsoft.com/en-us/data-integration/gateway/service-gateway-update

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References