CVE-2023-32021
published 2023-06-14CVE-2023-32021: Windows SMB Witness Service Security Feature Bypass Vulnerability
PriorityP337high7.1CVSS 3.1
AVNACLPRLUINSUCNILAH
EPSS
1.20%
64.8th percentile
Windows SMB Witness Service Security Feature Bypass Vulnerability
Affected
9 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.21013 | 6.3.9600.21013 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5989 | 10.0.14393.5989 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.4499 | 10.0.17763.4499 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1787 | 10.0.20348.1787 |
| msrc | windows_server_2012_r2 | — | — |
| msrc | windows_server_2016 | — | — |
| msrc | windows_server_2019 | — | — |
| msrc | windows_server_2022 | — | — |
CVSS provenance
nvdv3.17.1HIGHCVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:L/A:H
vendor_msrc7.1HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Windows SMB Witness Service Security Feature Bypass Vulnerability
vendor_msrc·2023-06-13·CVSS 7.1
CVE-2023-32021 [HIGH] Windows SMB Witness Service Security Feature Bypass Vulnerability
Windows SMB Witness Service Security Feature Bypass Vulnerability
FAQ: What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could execute RPC procedures that are restricted to privileged accounts, bypassing the access check for the RPC procedures.
FAQ: How could an attacker exploit the vulnerability?
To exploit this vulnerability, an attacker could execute a specially crafted malicious script which executes an RPC call to a Windows SMB Witness Service.
Windows SMB: Windows SMB
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Security Feature Bypass
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely
Reference: https://catalog.
GHSA
GHSA-3hjc-gv2m-96gh: Windows SMB Witness Service Security Feature Bypass Vulnerability
ghsa_unreviewed·2023-06-14
CVE-2023-32021 [HIGH] GHSA-3hjc-gv2m-96gh: Windows SMB Witness Service Security Feature Bypass Vulnerability
Windows SMB Witness Service Security Feature Bypass Vulnerability
No detection rules found.
No public exploits indexed.
Qualys
Microsoft and Adobe Patch Tuesday, June 2023 Security Update Review | Qualys
blogs_qualys·2023-06-13
Microsoft and Adobe Patch Tuesday, June 2023 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for June 2023
- Adobe Patches for June 2023
- Other Critical Severity Vulnerabilities Patched in June Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
Microsoft has released June’s edition of Patch Tuesday! This installment of security updates addressed 94 security vulnerabilities in various products, features, and roles.
## Microsoft Patch Tuesday for June 2023
No zero-day vulnerabil
Qualys
Microsoft and Adobe Patch Tuesday, June 2023 Security Update Review
blogs_qualys·2023-06-13
Microsoft and Adobe Patch Tuesday, June 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for June 2023
Adobe Patches for June 2023
Other Critical Severity Vulnerabilities Patched in June Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
Microsoft has released June’s edition of Patch Tuesday! This installment of security updates addressed 94 security vulnerabilities in various products, features, and roles.
## Microsoft Patch Tuesday for June 2023
No zero-day vulnerabilities known t
2023-06-14
Published