CVE-2011-0091 — Improper Authentication in Microsoft Windows Server 2008

CWE-287 — Improper Authentication2 documents2 sources
Severity
6.4MEDIUMNVD
EPSS
2.4%
top 15.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
1
Microsoft Windows Server 2008
Timeline
PublishedFeb 10
Latest updateMay 14

Description

Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 does not prevent a session from changing from strong encryption to DES encryption, which allows man-in-the-middle attackers to spoof network traffic and obtain sensitive information via a DES downgrade, aka "Kerberos Spoofing Vulnerability."

CVSS vector

AV:N/AC:L/C:P/I:P/A:NExploitability: 10.0 | Impact: 4.9

Affected Packages1 packages

🔴Vulnerability Details

1
GHSA
GHSA-49wj-vp5r-r79v: Kerberos in Microsoft Windows Server 2008 R2 and Windows 7 does not prevent a session from changing from strong encryption to DES encryption, which al↗2022-05-14
▶