CVE-2022-37967 - Vulnerability Details

Vendors	Products
Fedoraproject	Fedora
Microsoft	Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019 Windows Server 2022
Netapp	Management Services For Element Software Management Services For Netapp Hci
Samba	Samba

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967
https://nvd.nist.gov/vuln/detail/CVE-2022-37967
https://security.gentoo.org/glsa/202309-06
https://www.cve.org/CVERecord?id=CVE-2022-37967
https://www.samba.org/samba/security/CVE-2022-37967.html

Type	Values Removed	Values Added
CPEs	cpe:2.3:o:microsoft:windows_server_2008_R2:6.1.7601.26769::::::x64: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.22317::::::x64: cpe:2.3:o:microsoft:windows_server_2008_sp2:6.0.6003.22317::::::x86: cpe:2.3:o:microsoft:windows_server_2012:6.2.9200.24523::::::x64: cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.21620::::::x64: cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.6351:::::::* cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.4974:::::::* cpe:2.3:o:microsoft:windows_server_2022:10.0.20348.2031:::::::*
Vendors & Products	Microsoft windows Server 2008 R2 Microsoft windows Server 2008 Sp2 Microsoft windows Server 2012 R2

Type	Values Removed	Values Added
Metrics		ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'none', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

Show plain JSON

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"state": "PUBLISHED", "cveId": "CVE-2022-37967", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "dateUpdated": "2025-01-02T21:31:31.133Z", "dateReserved": "2022-08-08T00:00:00", "datePublished": "2022-11-09T00:00:00"}, "containers": {"cna": {"title": "Windows Kerberos Elevation of Privilege Vulnerability", "datePublic": "2022-11-08T08:00:00+00:00", "cpeApplicability": [{"nodes": [{"operator": "OR", "negate": false, "cpeMatch": [{"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.17763.0", "versionEndExcluding": "10.0.17763.4974"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.17763.0", "versionEndExcluding": "10.0.17763.4974"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.20348.0", "versionEndExcluding": "10.0.20348.2031"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.14393.0", "versionEndExcluding": "10.0.14393.6351"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "versionStartIncluding": "10.0.14393.0", "versionEndExcluding": "10.0.14393.6351"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.0.6003.0", "versionEndExcluding": "6.0.6003.22317"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.0.6003.0", "versionEndExcluding": "6.0.6003.22317"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x86:*", "versionStartIncluding": "6.0.6003.0", "versionEndExcluding": "6.0.6003.22317"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.1.7601.0", "versionEndExcluding": "6.1.7601.26769"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.1.7601.0", "versionEndExcluding": "6.1.7601.26769"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.2.9200.0", "versionEndExcluding": "6.2.9200.24523"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.2.9200.0", "versionEndExcluding": "6.2.9200.24523"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.3.9600.0", "versionEndExcluding": "6.3.9600.21620"}, {"vulnerable": true, "criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*", "versionStartIncluding": "6.3.9600.0", "versionEndExcluding": "6.3.9600.21620"}]}]}], "affected": [{"vendor": "Microsoft", "product": "Windows Server 2019", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2022", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.20348.0", "lessThan": "10.0.20348.2031", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2016", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "platforms": ["32-bit Systems"], "versions": [{"version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008  Service Pack 2", "platforms": ["x64-based Systems"], "versions": [{"version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "platforms": ["x64-based Systems"], "versions": [{"version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012", "platforms": ["x64-based Systems"], "versions": [{"version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2", "platforms": ["x64-based Systems"], "versions": [{"version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "platforms": ["x64-based Systems"], "versions": [{"version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Windows Kerberos Elevation of Privilege Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "Elevation of Privilege", "lang": "en-US", "type": "Impact"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-02T21:31:31.133Z"}, "references": [{"name": "Windows Kerberos Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 7.2, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:37:42.617Z"}, "title": "CVE Program Container", "references": [{"name": "Windows Kerberos Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967"}, {"url": "https://security.gentoo.org/glsa/202309-06", "tags": ["x_transferred"]}]}, {"metrics": [{"other": {"type": "ssvc", "content": {"timestamp": "2024-10-15T13:57:00.933042Z", "id": "CVE-2022-37967", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "role": "CISA Coordinator", "version": "2.0.3"}}}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:58:06.887Z"}}]}}

{

dataType : CVE_RECORD (string)

dataVersion : 5.1 (string)

cveMetadata : { »

state : PUBLISHED (string)

cveId : CVE-2022-37967 (string)

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

assignerShortName : microsoft (string)

dateUpdated : 2025-01-02T21:31:31.133Z (string)

dateReserved : 2022-08-08T00:00:00 (string)

datePublished : 2022-11-09T00:00:00 (string)

}

containers : { »

cna : { »

title : Windows Kerberos Elevation of Privilege Vulnerability (string)

datePublic : 2022-11-08T08:00:00+00:00 (string)

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

operator : OR (string)

negate : false (boolean)

cpeMatch : [ »

0 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 10.0.17763.0 (string)

versionEndExcluding : 10.0.17763.4974 (string)

}

1 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 10.0.17763.0 (string)

versionEndExcluding : 10.0.17763.4974 (string)

}

2 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 10.0.20348.0 (string)

versionEndExcluding : 10.0.20348.2031 (string)

}

3 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 10.0.14393.0 (string)

versionEndExcluding : 10.0.14393.6351 (string)

}

4 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* (string)

versionStartIncluding : 10.0.14393.0 (string)

versionEndExcluding : 10.0.14393.6351 (string)

}

5 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.0.6003.0 (string)

versionEndExcluding : 6.0.6003.22317 (string)

}

6 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.0.6003.0 (string)

versionEndExcluding : 6.0.6003.22317 (string)

}

7 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x86:* (string)

versionStartIncluding : 6.0.6003.0 (string)

versionEndExcluding : 6.0.6003.22317 (string)

}

8 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.1.7601.0 (string)

versionEndExcluding : 6.1.7601.26769 (string)

}

9 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.1.7601.0 (string)

versionEndExcluding : 6.1.7601.26769 (string)

}

10 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.2.9200.0 (string)

versionEndExcluding : 6.2.9200.24523 (string)

}

11 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.2.9200.0 (string)

versionEndExcluding : 6.2.9200.24523 (string)

}

12 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.3.9600.0 (string)

versionEndExcluding : 6.3.9600.21620 (string)

}

13 : { »

vulnerable : true (boolean)

criteria : cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:* (string)

versionStartIncluding : 6.3.9600.0 (string)

versionEndExcluding : 6.3.9600.21620 (string)

}

]

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Windows Server 2019 (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 10.0.17763.0 (string)

lessThan : 10.0.17763.4974 (string)

versionType : custom (string)

status : affected (string)

}

]

}

1 : { »

vendor : Microsoft (string)

product : Windows Server 2019 (Server Core installation) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 10.0.17763.0 (string)

lessThan : 10.0.17763.4974 (string)

versionType : custom (string)

status : affected (string)

}

]

}

2 : { »

vendor : Microsoft (string)

product : Windows Server 2022 (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 10.0.20348.0 (string)

lessThan : 10.0.20348.2031 (string)

versionType : custom (string)

status : affected (string)

}

]

}

3 : { »

vendor : Microsoft (string)

product : Windows Server 2016 (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 10.0.14393.0 (string)

lessThan : 10.0.14393.6351 (string)

versionType : custom (string)

status : affected (string)

}

]

}

4 : { »

vendor : Microsoft (string)

product : Windows Server 2016 (Server Core installation) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 10.0.14393.0 (string)

lessThan : 10.0.14393.6351 (string)

versionType : custom (string)

status : affected (string)

}

]

}

5 : { »

vendor : Microsoft (string)

product : Windows Server 2008 Service Pack 2 (string)

platforms : [ »

0 : 32-bit Systems (string)

]

versions : [ »

0 : { »

version : 6.0.6003.0 (string)

lessThan : 6.0.6003.22317 (string)

versionType : custom (string)

status : affected (string)

}

]

}

6 : { »

vendor : Microsoft (string)

product : Windows Server 2008 Service Pack 2 (Server Core installation) (string)

platforms : [ »

0 : 32-bit Systems (string)

1 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.0.6003.0 (string)

lessThan : 6.0.6003.22317 (string)

versionType : custom (string)

status : affected (string)

}

]

}

7 : { »

vendor : Microsoft (string)

product : Windows Server 2008 Service Pack 2 (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.0.6003.0 (string)

lessThan : 6.0.6003.22317 (string)

versionType : custom (string)

status : affected (string)

}

]

}

8 : { »

vendor : Microsoft (string)

product : Windows Server 2008 R2 Service Pack 1 (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.1.7601.0 (string)

lessThan : 6.1.7601.26769 (string)

versionType : custom (string)

status : affected (string)

}

]

}

9 : { »

vendor : Microsoft (string)

product : Windows Server 2008 R2 Service Pack 1 (Server Core installation) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.1.7601.0 (string)

lessThan : 6.1.7601.26769 (string)

versionType : custom (string)

status : affected (string)

}

]

}

10 : { »

vendor : Microsoft (string)

product : Windows Server 2012 (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.2.9200.0 (string)

lessThan : 6.2.9200.24523 (string)

versionType : custom (string)

status : affected (string)

}

]

}

11 : { »

vendor : Microsoft (string)

product : Windows Server 2012 (Server Core installation) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.2.9200.0 (string)

lessThan : 6.2.9200.24523 (string)

versionType : custom (string)

status : affected (string)

}

]

}

12 : { »

vendor : Microsoft (string)

product : Windows Server 2012 R2 (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.3.9600.0 (string)

lessThan : 6.3.9600.21620 (string)

versionType : custom (string)

status : affected (string)

}

]

}

13 : { »

vendor : Microsoft (string)

product : Windows Server 2012 R2 (Server Core installation) (string)

platforms : [ »

0 : x64-based Systems (string)

]

versions : [ »

0 : { »

version : 6.3.9600.0 (string)

lessThan : 6.3.9600.21620 (string)

versionType : custom (string)

status : affected (string)

}

]

}

]

descriptions : [ »

0 : { »

value : Windows Kerberos Elevation of Privilege Vulnerability (string)

lang : en-US (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

description : Elevation of Privilege (string)

lang : en-US (string)

type : Impact (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2025-01-02T21:31:31.133Z (string)

}

references : [ »

0 : { »

name : Windows Kerberos Elevation of Privilege Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967 (string)

}

]

metrics : [ »

0 : { »

format : CVSS (string)

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

cvssV3_1 : { »

version : 3.1 (string)

baseSeverity : HIGH (string)

baseScore : 7.2 (number)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (string)

}

]

}

adp : [ »

0 : { »

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T10:37:42.617Z (string)

}

title : CVE Program Container (string)

references : [ »

0 : { »

name : Windows Kerberos Elevation of Privilege Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967 (string)

}

1 : { »

url : https://security.gentoo.org/glsa/202309-06 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

}

1 : { »

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

timestamp : 2024-10-15T13:57:00.933042Z (string)

id : CVE-2022-37967 (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

role : CISA Coordinator (string)

version : 2.0.3 (string)

}

]

title : CISA ADP Vulnrichment (string)

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-15T13:58:06.887Z (string)

}

]

}

Show plain JSON

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967", "name": "Windows Kerberos Elevation of Privilege Vulnerability", "tags": ["vendor-advisory", "x_transferred"]}, {"url": "https://security.gentoo.org/glsa/202309-06", "tags": ["x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-03T10:37:42.617Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"other": {"type": "ssvc", "content": {"id": "CVE-2022-37967", "role": "CISA Coordinator", "options": [{"Exploitation": "none"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2024-10-15T13:57:00.933042Z"}}}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2024-10-15T13:57:13.101Z"}}], "cna": {"title": "Windows Kerberos Elevation of Privilege Vulnerability", "metrics": [{"format": "CVSS", "cvssV3_1": {"version": "3.1", "baseScore": 7.2, "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C"}, "scenarios": [{"lang": "en-US", "value": "GENERAL"}]}], "affected": [{"vendor": "Microsoft", "product": "Windows Server 2019", "versions": [{"status": "affected", "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2019 (Server Core installation)", "versions": [{"status": "affected", "version": "10.0.17763.0", "lessThan": "10.0.17763.4974", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2022", "versions": [{"status": "affected", "version": "10.0.20348.0", "lessThan": "10.0.20348.2031", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2016", "versions": [{"status": "affected", "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2016 (Server Core installation)", "versions": [{"status": "affected", "version": "10.0.14393.0", "lessThan": "10.0.14393.6351", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2", "versions": [{"status": "affected", "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom"}], "platforms": ["32-bit Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2008 Service Pack 2 (Server Core installation)", "versions": [{"status": "affected", "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom"}], "platforms": ["32-bit Systems", "x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2008  Service Pack 2", "versions": [{"status": "affected", "version": "6.0.6003.0", "lessThan": "6.0.6003.22317", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1", "versions": [{"status": "affected", "version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)", "versions": [{"status": "affected", "version": "6.1.7601.0", "lessThan": "6.1.7601.26769", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2012", "versions": [{"status": "affected", "version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2012 (Server Core installation)", "versions": [{"status": "affected", "version": "6.2.9200.0", "lessThan": "6.2.9200.24523", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2", "versions": [{"status": "affected", "version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom"}], "platforms": ["x64-based Systems"]}, {"vendor": "Microsoft", "product": "Windows Server 2012 R2 (Server Core installation)", "versions": [{"status": "affected", "version": "6.3.9600.0", "lessThan": "6.3.9600.21620", "versionType": "custom"}], "platforms": ["x64-based Systems"]}], "datePublic": "2022-11-08T08:00:00+00:00", "references": [{"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967", "name": "Windows Kerberos Elevation of Privilege Vulnerability", "tags": ["vendor-advisory"]}], "descriptions": [{"lang": "en-US", "value": "Windows Kerberos Elevation of Privilege Vulnerability"}], "problemTypes": [{"descriptions": [{"lang": "en-US", "type": "Impact", "description": "Elevation of Privilege"}]}], "cpeApplicability": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.17763.4974", "versionStartIncluding": "10.0.17763.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.17763.4974", "versionStartIncluding": "10.0.17763.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.20348.2031", "versionStartIncluding": "10.0.20348.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.14393.6351", "versionStartIncluding": "10.0.14393.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*", "vulnerable": true, "versionEndExcluding": "10.0.14393.6351", "versionStartIncluding": "10.0.14393.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.0.6003.22317", "versionStartIncluding": "6.0.6003.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.0.6003.22317", "versionStartIncluding": "6.0.6003.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x86:*", "vulnerable": true, "versionEndExcluding": "6.0.6003.22317", "versionStartIncluding": "6.0.6003.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.1.7601.26769", "versionStartIncluding": "6.1.7601.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.1.7601.26769", "versionStartIncluding": "6.1.7601.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.2.9200.24523", "versionStartIncluding": "6.2.9200.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.2.9200.24523", "versionStartIncluding": "6.2.9200.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.3.9600.21620", "versionStartIncluding": "6.3.9600.0"}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*", "vulnerable": true, "versionEndExcluding": "6.3.9600.21620", "versionStartIncluding": "6.3.9600.0"}], "operator": "OR"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2025-01-02T21:31:31.133Z"}}}, "cveMetadata": {"cveId": "CVE-2022-37967", "state": "PUBLISHED", "dateUpdated": "2025-01-02T21:31:31.133Z", "dateReserved": "2022-08-08T00:00:00", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2022-11-09T00:00:00", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{

dataType : CVE_RECORD (string)

containers : { »

adp : [ »

0 : { »

title : CVE Program Container (string)

references : [ »

0 : { »

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967 (string)

name : Windows Kerberos Elevation of Privilege Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

1 : x_transferred (string)

]

}

1 : { »

url : https://security.gentoo.org/glsa/202309-06 (string)

tags : [ »

0 : x_transferred (string)

]

}

]

providerMetadata : { »

orgId : af854a3a-2127-422b-91ae-364da2661108 (string)

shortName : CVE (string)

dateUpdated : 2024-08-03T10:37:42.617Z (string)

}

1 : { »

title : CISA ADP Vulnrichment (string)

metrics : [ »

0 : { »

other : { »

type : ssvc (string)

content : { »

id : CVE-2022-37967 (string)

role : CISA Coordinator (string)

options : [ »

0 : { »

Exploitation : none (string)

}

1 : { »

Automatable : no (string)

}

2 : { »

Technical Impact : total (string)

}

]

version : 2.0.3 (string)

timestamp : 2024-10-15T13:57:00.933042Z (string)

}

]

providerMetadata : { »

orgId : 134c704f-9b21-4f2e-91b3-4a467353bcc0 (string)

shortName : CISA-ADP (string)

dateUpdated : 2024-10-15T13:57:13.101Z (string)

}

]

cna : { »

title : Windows Kerberos Elevation of Privilege Vulnerability (string)

metrics : [ »

0 : { »

format : CVSS (string)

cvssV3_1 : { »

version : 3.1 (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C (string)

}

scenarios : [ »

0 : { »

lang : en-US (string)

value : GENERAL (string)

}

]

}

]

affected : [ »

0 : { »

vendor : Microsoft (string)

product : Windows Server 2019 (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0.17763.0 (string)

lessThan : 10.0.17763.4974 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

1 : { »

vendor : Microsoft (string)

product : Windows Server 2019 (Server Core installation) (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0.17763.0 (string)

lessThan : 10.0.17763.4974 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

2 : { »

vendor : Microsoft (string)

product : Windows Server 2022 (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0.20348.0 (string)

lessThan : 10.0.20348.2031 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

3 : { »

vendor : Microsoft (string)

product : Windows Server 2016 (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0.14393.0 (string)

lessThan : 10.0.14393.6351 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

4 : { »

vendor : Microsoft (string)

product : Windows Server 2016 (Server Core installation) (string)

versions : [ »

0 : { »

status : affected (string)

version : 10.0.14393.0 (string)

lessThan : 10.0.14393.6351 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

5 : { »

vendor : Microsoft (string)

product : Windows Server 2008 Service Pack 2 (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.0.6003.0 (string)

lessThan : 6.0.6003.22317 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : 32-bit Systems (string)

]

}

6 : { »

vendor : Microsoft (string)

product : Windows Server 2008 Service Pack 2 (Server Core installation) (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.0.6003.0 (string)

lessThan : 6.0.6003.22317 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : 32-bit Systems (string)

1 : x64-based Systems (string)

]

}

7 : { »

vendor : Microsoft (string)

product : Windows Server 2008 Service Pack 2 (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.0.6003.0 (string)

lessThan : 6.0.6003.22317 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

8 : { »

vendor : Microsoft (string)

product : Windows Server 2008 R2 Service Pack 1 (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.1.7601.0 (string)

lessThan : 6.1.7601.26769 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

9 : { »

vendor : Microsoft (string)

product : Windows Server 2008 R2 Service Pack 1 (Server Core installation) (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.1.7601.0 (string)

lessThan : 6.1.7601.26769 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

10 : { »

vendor : Microsoft (string)

product : Windows Server 2012 (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.2.9200.0 (string)

lessThan : 6.2.9200.24523 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

11 : { »

vendor : Microsoft (string)

product : Windows Server 2012 (Server Core installation) (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.2.9200.0 (string)

lessThan : 6.2.9200.24523 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

12 : { »

vendor : Microsoft (string)

product : Windows Server 2012 R2 (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.3.9600.0 (string)

lessThan : 6.3.9600.21620 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

13 : { »

vendor : Microsoft (string)

product : Windows Server 2012 R2 (Server Core installation) (string)

versions : [ »

0 : { »

status : affected (string)

version : 6.3.9600.0 (string)

lessThan : 6.3.9600.21620 (string)

versionType : custom (string)

}

]

platforms : [ »

0 : x64-based Systems (string)

]

}

]

datePublic : 2022-11-08T08:00:00+00:00 (string)

references : [ »

0 : { »

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967 (string)

name : Windows Kerberos Elevation of Privilege Vulnerability (string)

tags : [ »

0 : vendor-advisory (string)

]

}

]

descriptions : [ »

0 : { »

lang : en-US (string)

value : Windows Kerberos Elevation of Privilege Vulnerability (string)

}

]

problemTypes : [ »

0 : { »

descriptions : [ »

0 : { »

lang : en-US (string)

type : Impact (string)

description : Elevation of Privilege (string)

}

]

}

]

cpeApplicability : [ »

0 : { »

nodes : [ »

0 : { »

negate : false (boolean)

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 10.0.17763.4974 (string)

versionStartIncluding : 10.0.17763.0 (string)

}

1 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 10.0.17763.4974 (string)

versionStartIncluding : 10.0.17763.0 (string)

}

2 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 10.0.20348.2031 (string)

versionStartIncluding : 10.0.20348.0 (string)

}

3 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 10.0.14393.6351 (string)

versionStartIncluding : 10.0.14393.0 (string)

}

4 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* (string)

vulnerable : true (boolean)

versionEndExcluding : 10.0.14393.6351 (string)

versionStartIncluding : 10.0.14393.0 (string)

}

5 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.0.6003.22317 (string)

versionStartIncluding : 6.0.6003.0 (string)

}

6 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.0.6003.22317 (string)

versionStartIncluding : 6.0.6003.0 (string)

}

7 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x86:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.0.6003.22317 (string)

versionStartIncluding : 6.0.6003.0 (string)

}

8 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.1.7601.26769 (string)

versionStartIncluding : 6.1.7601.0 (string)

}

9 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.1.7601.26769 (string)

versionStartIncluding : 6.1.7601.0 (string)

}

10 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.2.9200.24523 (string)

versionStartIncluding : 6.2.9200.0 (string)

}

11 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.2.9200.24523 (string)

versionStartIncluding : 6.2.9200.0 (string)

}

12 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.3.9600.21620 (string)

versionStartIncluding : 6.3.9600.0 (string)

}

13 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:* (string)

vulnerable : true (boolean)

versionEndExcluding : 6.3.9600.21620 (string)

versionStartIncluding : 6.3.9600.0 (string)

}

]

operator : OR (string)

}

]

}

]

providerMetadata : { »

orgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

shortName : microsoft (string)

dateUpdated : 2025-01-02T21:31:31.133Z (string)

}

cveMetadata : { »

cveId : CVE-2022-37967 (string)

state : PUBLISHED (string)

dateUpdated : 2025-01-02T21:31:31.133Z (string)

dateReserved : 2022-08-08T00:00:00 (string)

assignerOrgId : f38d906d-7342-40ea-92c1-6c4a2c6478c8 (string)

datePublished : 2022-11-09T00:00:00 (string)

assignerShortName : microsoft (string)

}

dataVersion : 5.1 (string)

}

Show plain JSON

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*", "matchCriteriaId": "5F422A8C-2C4E-42C8-B420-E0728037E15C", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*", "matchCriteriaId": "AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*", "matchCriteriaId": "A7DF96F8-BA6A-4780-9CA3-F719B3F81074", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*", "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*", "matchCriteriaId": "041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:*", "matchCriteriaId": "DB79EE26-FC32-417D-A49C-A1A63165A968", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:*", "matchCriteriaId": "821614DD-37DD-44E2-A8A4-FE8D23A33C3C", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:*", "matchCriteriaId": "5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD", "vulnerable": true}, {"criteria": "cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:*", "matchCriteriaId": "E30D0E6F-4AE8-4284-8716-991DFA48CC5D", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:*", "matchCriteriaId": "86B51137-28D9-41F2-AFA2-3CC22B4954D1", "vulnerable": true}, {"criteria": "cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:*", "matchCriteriaId": "4455CF3A-CC91-4BE4-A7AB-929AC82E34F5", "vulnerable": true}], "negate": false, "operator": "OR"}]}, {"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "703773B3-EE5B-41F5-A2D9-B56F96B8793D", "versionEndExcluding": "4.15.13", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "10AA6759-95FC-47A6-AA92-342893A2B23E", "versionEndExcluding": "4.16.8", "versionStartIncluding": "4.16.0", "vulnerable": true}, {"criteria": "cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:*", "matchCriteriaId": "96E911B3-B4DD-451C-9579-74559328F89F", "versionEndExcluding": "4.17.4", "versionStartIncluding": "4.17.0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Windows Kerberos Elevation of Privilege Vulnerability"}, {"lang": "es", "value": "Vulnerabilidad de elevaci\u00f3n de privilegios de Kerberos en Windows"}], "id": "CVE-2022-37967", "lastModified": "2025-01-02T22:15:10.010", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.2, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "HIGH", "scope": "UNCHANGED", "userInteraction": "NONE", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.2, "impactScore": 5.9, "source": "secure@microsoft.com", "type": "Secondary"}]}, "published": "2022-11-09T22:15:14.590", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Third Party Advisory"], "url": "https://security.gentoo.org/glsa/202309-06"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "NVD-CWE-noinfo"}], "source": "nvd@nist.gov", "type": "Primary"}]}

{

configurations : [ »

0 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:* (string)

matchCriteriaId : 5F422A8C-2C4E-42C8-B420-E0728037E15C (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* (string)

matchCriteriaId : AF07A81D-12E5-4B1D-BFF9-C8D08C32FF4F (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:* (string)

matchCriteriaId : A7DF96F8-BA6A-4780-9CA3-F719B3F81074 (string)

vulnerable : true (boolean)

}

3 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* (string)

matchCriteriaId : DB18C4CE-5917-401E-ACF7-2747084FD36E (string)

vulnerable : true (boolean)

}

4 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 041FF8BA-0B12-4A1F-B4BF-9C4F33B7C1E7 (string)

vulnerable : true (boolean)

}

5 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2019:-:*:*:*:*:*:*:* (string)

matchCriteriaId : DB79EE26-FC32-417D-A49C-A1A63165A968 (string)

vulnerable : true (boolean)

}

6 : { »

criteria : cpe:2.3:o:microsoft:windows_server_2022:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 821614DD-37DD-44E2-A8A4-FE8D23A33C3C (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

1 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:o:fedoraproject:fedora:36:*:*:*:*:*:*:* (string)

matchCriteriaId : 5C675112-476C-4D7C-BCB9-A2FB2D0BC9FD (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:o:fedoraproject:fedora:37:*:*:*:*:*:*:* (string)

matchCriteriaId : E30D0E6F-4AE8-4284-8716-991DFA48CC5D (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

2 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:netapp:management_services_for_element_software:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 86B51137-28D9-41F2-AFA2-3CC22B4954D1 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:netapp:management_services_for_netapp_hci:-:*:*:*:*:*:*:* (string)

matchCriteriaId : 4455CF3A-CC91-4BE4-A7AB-929AC82E34F5 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

3 : { »

nodes : [ »

0 : { »

cpeMatch : [ »

0 : { »

criteria : cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 703773B3-EE5B-41F5-A2D9-B56F96B8793D (string)

versionEndExcluding : 4.15.13 (string)

vulnerable : true (boolean)

}

1 : { »

criteria : cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 10AA6759-95FC-47A6-AA92-342893A2B23E (string)

versionEndExcluding : 4.16.8 (string)

versionStartIncluding : 4.16.0 (string)

vulnerable : true (boolean)

}

2 : { »

criteria : cpe:2.3:a:samba:samba:*:*:*:*:*:*:*:* (string)

matchCriteriaId : 96E911B3-B4DD-451C-9579-74559328F89F (string)

versionEndExcluding : 4.17.4 (string)

versionStartIncluding : 4.17.0 (string)

vulnerable : true (boolean)

}

]

negate : false (boolean)

operator : OR (string)

}

]

}

]

cveTags : [ *empty* ]

descriptions : [ »

0 : { »

lang : en (string)

value : Windows Kerberos Elevation of Privilege Vulnerability (string)

}

1 : { »

lang : es (string)

value : Vulnerabilidad de elevación de privilegios de Kerberos en Windows (string)

}

]

id : CVE-2022-37967 (string)

lastModified : 2025-01-02T22:15:10.010 (string)

metrics : { »

cvssMetricV31 : [ »

0 : { »

cvssData : { »

attackComplexity : LOW (string)

attackVector : NETWORK (string)

availabilityImpact : HIGH (string)

baseScore : 7.2 (number)

baseSeverity : HIGH (string)

confidentialityImpact : HIGH (string)

integrityImpact : HIGH (string)

privilegesRequired : HIGH (string)

scope : UNCHANGED (string)

userInteraction : NONE (string)

vectorString : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

version : 3.1 (string)

}

exploitabilityScore : 1.2 (number)

impactScore : 5.9 (number)

source : secure@microsoft.com (string)

type : Secondary (string)

}

]

}

published : 2022-11-09T22:15:14.590 (string)

references : [ »

0 : { »

source : secure@microsoft.com (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967 (string)

}

1 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Patch (string)

1 : Vendor Advisory (string)

]

url : https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-37967 (string)

}

2 : { »

source : af854a3a-2127-422b-91ae-364da2661108 (string)

tags : [ »

0 : Third Party Advisory (string)

]

url : https://security.gentoo.org/glsa/202309-06 (string)

}

]

sourceIdentifier : secure@microsoft.com (string)

vulnStatus : Modified (string)

weaknesses : [ »

0 : { »

description : [ »

0 : { »

lang : en (string)

value : NVD-CWE-noinfo (string)

}

]

source : nvd@nist.gov (string)

type : Primary (string)

}

]

}

Show plain JSON

{"bugzilla": {"description": "samba: krb5: Kerberos constrained delegation ticket forgery possible against Samba AD DC", "id": "2154320", "url": "https://bugzilla.redhat.com/show_bug.cgi?id=2154320"}, "csaw": false, "cvss3": {"cvss3_base_score": "7.2", "cvss3_scoring_vector": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H", "status": "draft"}, "cwe": "CWE-328", "details": ["Windows Kerberos Elevation of Privilege Vulnerability", "A Kerberos elevation of privilege vulnerability was found in all versions Samba AD DC. It exploits weaknesses in the RC4-HMAC cipher, allowing a service account with constrained delegation permission to forge a more powerful Kerberos ticket. This flaw could enable privilege escalation by adding unauthorized groups to the Privilege Attribute Certificate (PAC) without knowing the krbtgt key."], "mitigation": {"lang": "en:us", "value": "Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability."}, "name": "CVE-2022-37967", "package_state": [{"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "aap-cloud-metrics-collector-container", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-24/ee-minimal-rhel9", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-24/ee-supported-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-24/platform-resource-runner-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/a:redhat:ansible_automation_platform:2", "fix_state": "Affected", "package_name": "ansible-automation-platform-25/ansible-builder-rhel8", "product_name": "Red Hat Ansible Automation Platform 2"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:6", "fix_state": "Not affected", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 6"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:7", "fix_state": "Not affected", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 7"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:8", "fix_state": "Not affected", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 8"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Affected", "package_name": "krb5", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/o:redhat:enterprise_linux:9", "fix_state": "Not affected", "package_name": "samba", "product_name": "Red Hat Enterprise Linux 9"}, {"cpe": "cpe:/a:redhat:openshift:4", "fix_state": "Affected", "package_name": "rhcos", "product_name": "Red Hat OpenShift Container Platform 4"}, {"cpe": "cpe:/a:redhat:storage:3", "fix_state": "Not affected", "package_name": "samba", "product_name": "Red Hat Storage 3"}], "public_date": "2022-12-16T00:00:00Z", "references": ["https://www.cve.org/CVERecord?id=CVE-2022-37967\nhttps://nvd.nist.gov/vuln/detail/CVE-2022-37967\nhttps://www.samba.org/samba/security/CVE-2022-37967.html"], "statement": "The Samba package as shipped with Red Hat Enterprise Linux 6, 7, 8 and 9 Red Hat Gluster is not affected by this issue as Red Hat doesn't provide the AD domain controller capability with it.", "threat_severity": "Important"}

{

bugzilla : { »

description : samba: krb5: Kerberos constrained delegation ticket forgery possible against Samba AD DC (string)

id : 2154320 (string)

url : https://bugzilla.redhat.com/show_bug.cgi?id=2154320 (string)

}

csaw : false (boolean)

cvss3 : { »

cvss3_base_score : 7.2 (string)

cvss3_scoring_vector : CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H (string)

status : draft (string)

}

cwe : CWE-328 (string)

details : [ »

0 : Windows Kerberos Elevation of Privilege Vulnerability (string)

1 : A Kerberos elevation of privilege vulnerability was found in all versions Samba AD DC. It exploits weaknesses in the RC4-HMAC cipher, allowing a service account with constrained delegation permission to forge a more powerful Kerberos ticket. This flaw could enable privilege escalation by adding unauthorized groups to the Privilege Attribute Certificate (PAC) without knowing the krbtgt key. (string)

]

mitigation : { »

lang : en:us (string)

value : Mitigation for this issue is either not available or the currently available options do not meet the Red Hat Product Security criteria comprising ease of use and deployment, applicability to widespread installation base or stability. (string)

}

name : CVE-2022-37967 (string)

package_state : [ »

0 : { »

cpe : cpe:/a:redhat:ansible_automation_platform:2 (string)

fix_state : Affected (string)

package_name : aap-cloud-metrics-collector-container (string)

product_name : Red Hat Ansible Automation Platform 2 (string)

}

1 : { »

cpe : cpe:/a:redhat:ansible_automation_platform:2 (string)

fix_state : Affected (string)

package_name : ansible-automation-platform-24/ee-minimal-rhel9 (string)

product_name : Red Hat Ansible Automation Platform 2 (string)

}

2 : { »

cpe : cpe:/a:redhat:ansible_automation_platform:2 (string)

fix_state : Affected (string)

package_name : ansible-automation-platform-24/ee-supported-rhel8 (string)

product_name : Red Hat Ansible Automation Platform 2 (string)

}

3 : { »

cpe : cpe:/a:redhat:ansible_automation_platform:2 (string)

fix_state : Affected (string)

package_name : ansible-automation-platform-24/platform-resource-runner-rhel8 (string)

product_name : Red Hat Ansible Automation Platform 2 (string)

}

4 : { »

cpe : cpe:/a:redhat:ansible_automation_platform:2 (string)

fix_state : Affected (string)

package_name : ansible-automation-platform-25/ansible-builder-rhel8 (string)

product_name : Red Hat Ansible Automation Platform 2 (string)

}

5 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Affected (string)

package_name : krb5 (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

6 : { »

cpe : cpe:/o:redhat:enterprise_linux:6 (string)

fix_state : Not affected (string)

package_name : samba (string)

product_name : Red Hat Enterprise Linux 6 (string)

}

7 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Affected (string)

package_name : krb5 (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

8 : { »

cpe : cpe:/o:redhat:enterprise_linux:7 (string)

fix_state : Not affected (string)

package_name : samba (string)

product_name : Red Hat Enterprise Linux 7 (string)

}

9 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Affected (string)

package_name : krb5 (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

10 : { »

cpe : cpe:/o:redhat:enterprise_linux:8 (string)

fix_state : Not affected (string)

package_name : samba (string)

product_name : Red Hat Enterprise Linux 8 (string)

}

11 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Affected (string)

package_name : krb5 (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

12 : { »

cpe : cpe:/o:redhat:enterprise_linux:9 (string)

fix_state : Not affected (string)

package_name : samba (string)

product_name : Red Hat Enterprise Linux 9 (string)

}

13 : { »

cpe : cpe:/a:redhat:openshift:4 (string)

fix_state : Affected (string)

package_name : rhcos (string)

product_name : Red Hat OpenShift Container Platform 4 (string)

}

14 : { »

cpe : cpe:/a:redhat:storage:3 (string)

fix_state : Not affected (string)

package_name : samba (string)

product_name : Red Hat Storage 3 (string)

}

]

public_date : 2022-12-16T00:00:00Z (string)

references : [ »

0 : https://www.cve.org/CVERecord?id=CVE-2022-37967 https://nvd.nist.gov/vuln/detail/CVE-2022-37967 https://www.samba.org/samba/security/CVE-2022-37967.html (string)

]

statement : The Samba package as shipped with Red Hat Enterprise Linux 6, 7, 8 and 9 Red Hat Gluster is not affected by this issue as Red Hat doesn't provide the AD domain controller capability with it. (string)

threat_severity : Important (string)

}

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

Metrics

Attack Vector Network

Attack Complexity Low

Privileges Required High

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction None

Exploitation none

Automatable no

Technical Impact total

Affected Vendors & Products

JSON object

JSON object

JSON object

JSON object