⚠ Actively exploited

Added to CISA KEV on 2022-01-10. Federal agencies required to patch by 2022-07-10. Required action: Apply updates per vendor instructions..

CVE-2013-3900 — Improper Verification of Cryptographic Signature in Microsoft Windows 10 Version 1507

CWE-347 — Improper Verification of Cryptographic Signature CWE-20 — Improper Input Validation27 documents10 sources

Severity

8.8HIGHNVD

VulnCheck5.5

EPSS

78.1%

top 0.98%

CISA KEV

KEV

Added 2022-01-10

Due 2022-07-10

Exploit

Exploited in wild

Active exploitation observed

Affected products

Microsoft Windows 10 Version 1507 Microsoft Windows 10 Version 1607 Microsoft Windows 10 Version 1809 +32 more

Timeline

PublishedDec 11

KEV addedJan 10

KEV dueJul 10

Latest updateNov 19

CISA Required Action: Apply updates per vendor instructions.

Description

Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the origi…

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages35 packages

▶NVDmicrosoft/windowsr2

▶CVEListV5microsoft/windows_server_2012N/A

▶CVEListV5microsoft/windows_server_2016N/A

▶CVEListV5microsoft/windows_server_2019N/A

▶CVEListV5microsoft/windows_server_2022N/A

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-8cj2-jg77-qj2p: The WinVerifyTrust function in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windo↗2022-05-03

▶

VulnCheck

Microsoft WinVerifyTrust function Remote Code Execution↗2013

▶

📋Vendor Advisories

Microsoft

WinVerifyTrust Signature Validation Vulnerability↗2022-01-11

▶

CISA

Microsoft WinVerifyTrust function Remote Code Execution↗2022-01-10

▶