CVE-2021-24092

CWE-269 — Improper Privilege Management6 documents5 sources

Severity

7.8HIGH

EPSS

0.4%

top 38.45%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

7

Microsoft Microsoft Endpoint Protection Microsoft Microsoft Security Essentials Microsoft Microsoft System Center 2012 Endpoint Protection +4 more

Timeline

PublishedFeb 25

Latest updateMay 24

Description

Microsoft Defender Elevation of Privilege Vulnerability

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.8 | Impact: 5.9

Affected Packages7 packages

▶CVEListV5microsoft/windows_defenderN/A

▶CVEListV5microsoft/microsoft_endpoint_protectionN/A

▶CVEListV5microsoft/microsoft_security_essentialsN/A

▶NVDmicrosoft/system_center_endpoint_protection2012

▶CVEListV5microsoft/microsoft_system_center_endpoint_protectionN/A

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2

GHSA

GHSA-rh6f-h7jm-q6qr: Microsoft Defender Elevation of Privilege Vulnerability↗2022-05-24

▶

CVEList

Microsoft Defender Elevation of Privilege Vulnerability↗2021-02-25

▶

📋Vendor Advisories

1

Microsoft

Microsoft Defender Elevation of Privilege Vulnerability↗2021-02-09

▶

🕵️Threat Intelligence

1

Sentinelone

CVE-2021-24092: 12 Years in Hiding – A Privilege Escalation Vulnerability in Windows Defender↗2021-02-11

▶

CVE-2021-24092 (HIGH CVSS 7.8) | Microsoft Defender Elevation of Pri | cvebase.io