CVE-2021-42282
published 2021-11-10CVE-2021-42282: Active Directory Domain Services Elevation of Privilege Vulnerability
PriorityP352high8.8CVSS 3.1
AVNACLPRLUINSUCHIHAH
EPSS
3.80%
89.2th percentile
Active Directory Domain Services Elevation of Privilege Vulnerability
Affected
24 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.25769 | 6.1.7601.25769 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.21282 | 6.0.6003.21282 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.23517 | 6.2.9200.23517 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20174 | 6.3.9600.20174 |
| microsoft | windows_server_2016 | — | — |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.4770 | 10.0.14393.4770 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.2300 | 10.0.17763.2300 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.350 | 10.0.20348.350 |
| microsoft | windows_server_version_2004 | >= 10.0.0 < 10.0.19041.1348 | 10.0.19041.1348 |
| microsoft | windows_server_version_20h2 | >= 10.0.0 < 10.0.19041.1348 | 10.0.19041.1348 |
| msrc | windows_server_2008_for_32-bit_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_for_x64-based_systems_service_pack_2 | — | — |
| msrc | windows_server_2008_r2_for_x64-based_systems_service_pack_1 | — | — |
| msrc | windows_server_2012 | — | — |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
| msrc | windows_server_2019 | — | — |
| msrc | windows_server_2022 | — | — |
| msrc | windows_server_version_2004 | — | — |
| msrc | windows_server_version_20h2 | — | — |
CVSS provenance
nvdv3.18.8HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H
nvdv2.06.5MEDIUMAV:N/AC:L/Au:S/C:P/I:P/A:P
vendor_msrc7.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-chp6-c7f5-h9w9: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2021-42278 [HIGH] CWE-20 GHSA-chp6-c7f5-h9w9: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291
Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42282, CVE-2021-42287, CVE-2021-42291.
GHSA
GHSA-ffqv-33xf-m57q: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42287
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2021-42291 [HIGH] CWE-269 GHSA-ffqv-33xf-m57q: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42287
Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42287.
GHSA
GHSA-737r-5j68-97hh: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2021-42287 [HIGH] CWE-269 GHSA-737r-5j68-97hh: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291
Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42282, CVE-2021-42291.
GHSA
GHSA-gh7f-5g36-2xw3: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42287, CVE-2021-42291
ghsa_unreviewed·2022-05-24·CVSS 7.5
CVE-2021-42282 [HIGH] CWE-269 GHSA-gh7f-5g36-2xw3: Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42287, CVE-2021-42291
Active Directory Domain Services Elevation of Privilege Vulnerability This CVE ID is unique from CVE-2021-42278, CVE-2021-42287, CVE-2021-42291.
Microsoft
Active Directory Domain Services Elevation of Privilege Vulnerability
vendor_msrc·2021-11-09·CVSS 7.5
CVE-2021-42282 [HIGH] Active Directory Domain Services Elevation of Privilege Vulnerability
Active Directory Domain Services Elevation of Privilege Vulnerability
FAQ: Where can I find more information about Verification of uniqueness for user principal name, service principal name, or the service principal name alias?
See Verification of uniqueness for user principal name, service principal name, and the service principal name alias.
Windows Active Directory: Windows Active Directory
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Elevation of Privilege
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:Exploitation Less Likely
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5007206
Reference: https://support.microsoft.com/help/5007206
Reference: https://catalog.upd
No detection rules found.
No public exploits indexed.
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Ausnutzung von Schwachstellen
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulne
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits y vulnerabilidades
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnera
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits & Vulnerabilities
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerab
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits & Vulnerabilities
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro 2021/11/10 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerabil
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Exploits & Vulnerabilities
# November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro
2021/11/10
Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerabil
Trendmicro
November Continues Streak of Quiet Patch Tuesdays
blogs_trendmicro·2021-11-10·CVSS 9.0
[CRITICAL] November Continues Streak of Quiet Patch Tuesdays
Sfruttamento vulnerabilità
## November Continues Streak of Quiet Patch Tuesdays
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November.
By: Trend Micro Nov 10, 2021 Read time: ( words)
Save to Folio
November continues a recent pattern of relatively peaceful Patch Tuesday cycles. There were only six vulnerabilities rated as Critical this month, with 49 more rated as Important for a total of 55 for the month of November (less than half of the vulnerabilities in November last year). Of these 55, four were submitted via the Zero Day Initiative (ZDI).
Critical Vulnerabilities: Defender, Remote Desktop
Two Critical vulnerab
2021-11-10
Published