CVE-2022-37966 - OpenCVE

Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity High

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Exploitation none

Automatable no

Technical Impact total

Vendors	Products
Fedoraproject	Fedora
Microsoft	Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022
Netapp	Management Services For Element Software Management Services For Netapp Hci
Samba	Samba

Configuration 1 [-]

OR	cpe:2.3:o:microsoft:windows_server_2008:-:sp2::::::
	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:::::x64:*
	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*
	cpe:2.3:o:microsoft:windows_server_2016:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2019:-:::::::*
	cpe:2.3:o:microsoft:windows_server_2022:-:::::::*

Configuration 2 [-]

OR	cpe:2.3:o:fedoraproject:fedora:36:::::::*
	cpe:2.3:o:fedoraproject:fedora:37:::::::*

Configuration 3 [-]

OR	cpe:2.3:a:netapp:management_services_for_element_software:-:::::::*
	cpe:2.3:a:netapp:management_services_for_netapp_hci:-:::::::*

Configuration 4 [-]

OR	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::
	cpe:2.3:a:samba:samba::::::::

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966
https://nvd.nist.gov/vuln/detail/CVE-2022-37966
https://security.gentoo.org/glsa/202309-06
https://www.cve.org/CVERecord?id=CVE-2022-37966
https://www.samba.org/samba/security/CVE-2022-37966.html

History

Tue, 15 Oct 2024 14:15:00 +0000

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2022-11-09T00:00:00

Updated: 2024-10-15T13:51:22.379Z

Reserved: 2022-08-08T00:00:00

Link: CVE-2022-37966

Vulnrichment

Updated: 2024-08-03T10:37:42.598Z

NVD

Status : Modified

Published: 2022-11-09T22:15:13.603

Modified: 2023-09-17T09:15:11.040

Link: CVE-2022-37966

Redhat

Severity : Important

Publid Date: 2022-12-16T00:00:00Z

Links: CVE-2022-37966 - Bugzilla

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-37966", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "dateUpdated": "2024-10-15T13:51:22.379Z", "dateReserved": "2022-08-08T00:00:00", "datePublished": "2022-11-09T00:00:00"}, "containers": {"cna": {"title": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability", "datePublic": "2022-11-08T08:00:00+00:00", "affected": [{"vendor": "Microsoft", "product": "Windows Server 2019", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2022", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2016", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "cpes": [], "platforms": ["32-bit Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "cpes": [], "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "cpes": [], "platforms": ["x64-based Systems"], "versions": [{"version": "N/A", "status": "affected"}]}], "descriptions": [{"value": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Elevation of Privilege", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-05-29T14:01:42.756Z"}, "references": [{"name": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966"}, {"url": "https://security.gentoo.org/glsa/202309-06"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.1, "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:37:42.598Z"}, "title": "CVE Program Container", "references": [{"name": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966"}, {"url": "https://security.gentoo.org/glsa/202309-06", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T13:50:56.816223Z", "id": "CVE-2022-37966", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:51:22.379Z"}}]}}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966", "name": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202309-06", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:37:42.598Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-37966", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T13:50:56.816223Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:51:12.394Z"}}], "cna": {"title": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 8.1, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2019", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2022", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2016", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["32-bit Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2012", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2012 R2", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}, {"cpes": [], "vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "versions": [{"status": "affected", "version": "N/A"}], "platforms": ["x64-based Systems"]}], "datePublic": "2022-11-08T08:00:00+00:00", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966", "name": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"]}, {"url": "https://security.gentoo.org/glsa/202309-06"}], "descriptions": [{"lang": "en-US", "value": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "Impact", "description": "Elevation of Privilege"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-05-29T14:01:42.756Z"}}}, "cveMetadata": {"cveId": "CVE-2022-37966", "state": "PUBLISHED", "dateUpdated": "2024-10-15T13:51:22.379Z", "dateReserved": "2022-08-08T00:00:00", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2022-11-09T00:00:00", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*", "matchCriteriaId": "86B51137-28D9-41F2-AFA2-3CC22B4954D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*", "matchCriteriaId": "4455CF3A-CC91-4BE4-A7AB-929AC82E34F5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "6A4AE564-BFC2-47FA-9AB9-573BCA9BF649", "versionStartExcluding": "4.15.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "10AA6759-95FC-47A6-AA92-342893A2B23E", "versionEndExcluding": "4.16.8", "versionStartIncluding": "4.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "96E911B3-B4DD-451C-9579-74559328F89F", "versionEndExcluding": "4.17.4", "versionStartIncluding": "4.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Windows Kerberos RC4-HMAC Elevation of Privilege Vulnerability"}, {"lang": "es", "value": "Vulnerabilidad de elevaci\u00f3n de privilegios en Kerberos RC4-HMAC de Windows"}], "id": "CVE-2022-37966", "lastModified": "2023-09-17T09:15:11.040", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.1, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.2, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Primary"}]}, "published": "2022-11-09T22:15:13.603", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37966"}, {"source": "secure@microsoft.com", "url": "https://security.gentoo.org/glsa/202309-06"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}