CVE-2023-36914
published 2023-08-08CVE-2023-36914: Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
PriorityP425medium5.5CVSS 3.1
AVLACLPRLUINSUCHINAN
EPSS
0.59%
43.5th percentile
Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_21h2 | — | — |
| microsoft | windows_10_22h2 | — | — |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.3324 | 10.0.19044.3324 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.3324 | 10.0.19045.3324 |
| microsoft | windows_11_21h2 | — | — |
| microsoft | windows_11_22h2 | — | — |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.2295 | 10.0.22000.2295 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.2134 | 10.0.22621.2134 |
| microsoft | windows_server_2022 | >= 10.0.20348.0 < 10.0.20348.1906 | 10.0.20348.1906 |
| msrc | windows_10_version_21h2_for_32-bit_systems | — | — |
| msrc | windows_10_version_21h2_for_arm64-based_systems | — | — |
| msrc | windows_10_version_21h2_for_x64-based_systems | — | — |
| msrc | windows_10_version_22h2_for_32-bit_systems | — | — |
| msrc | windows_10_version_22h2_for_arm64-based_systems | — | — |
| msrc | windows_10_version_22h2_for_x64-based_systems | — | — |
| msrc | windows_11_version_21h2_for_arm64-based_systems | — | — |
| msrc | windows_11_version_21h2_for_x64-based_systems | — | — |
| msrc | windows_11_version_22h2_for_arm64-based_systems | — | — |
| msrc | windows_11_version_22h2_for_x64-based_systems | — | — |
| msrc | windows_server_2022 | — | — |
CVSS provenance
nvdv3.15.5MEDIUMCVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
vendor_msrc5.5MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hfm3-j43v-9h2m: Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
ghsa_unreviewed·2023-08-08
CVE-2023-36914 [MEDIUM] GHSA-hfm3-j43v-9h2m: Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
Microsoft
Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
vendor_msrc·2023-08-08·CVSS 5.5
CVE-2023-36914 [MEDIUM] Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability
FAQ: What kind of security feature could be bypassed by successfully exploiting this vulnerability?
An attacker who successfully exploited this vulnerability could bypass the Fast Identity Online (FIDO) secure authentication feature.
Windows Smart Card: Windows Smart Card
Microsoft: Microsoft
Customer Action Required: Yes
Impact: Security Feature Bypass
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;DOS:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5029250
Reference: https://support.microsoft.com/help/5029250
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB5029367
Reference: https://support.m
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2023-08-08
Published