CVE-2021-42287
Published: 10 November 2021
Summary
CVE-2021-42287 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.5 (High).
Operationally, ranked in the top 0.1% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 AC-6 (Least Privilege) and SI-2 (Flaw Remediation).
Deeper analysis
CVE-2021-42287 is an elevation of privilege vulnerability affecting Active Directory Domain Services. The flaw carries a CVSS 3.1 base score of 7.5 with a network attack vector, high attack complexity, and low privileges required, enabling high impact to confidentiality, integrity, and availability on domain controllers.
An authenticated attacker with low privileges can exploit the issue over the network to obtain elevated rights within an Active Directory environment, although successful exploitation requires specific conditions that increase complexity.
Microsoft has published security guidance and patches addressing the vulnerability through its Security Response Center. The flaw is also catalogued by CISA among vulnerabilities known to have been exploited in the wild.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2021-29262
Vulnerability details
Active Directory Domain Services Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 11 April 2022
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely installation of the vendor patch that eliminates the AD DS privilege-escalation flaw.
Enforces least-privilege assignments so that the low-privileged accounts required by the attacker cannot reach the vulnerable code paths.
Enforces the access-control policy that should block the unauthorized elevation of rights on domain controllers.