Cyber Resilience

CVE-2023-38151

Microsoft Host Integration Server 2020

Published
14 November 2023
Modified
21 November 2024
Patch / advisory
CVSS Score v3.1 8.8
Click a component to see what it means
Raw vectorCVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
EPSS Score 0.018 76th percentile
Risk Priority 68 floored blend · peak EPSS

Summary

CVE-2023-38151 is a high-severity Use of Uninitialized Resource (CWE-908) vulnerability in Microsoft Host Integration Server. Its CVSS base score is 8.8 (High).

Operationally, exploitation aligns with the MITRE ATT&CK technique OS Credential Dumping (T1003); ranked in the top 24% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

EU & UK References

Vulnerability Data

Microsoft Host Integration Server 2020 Remote Code Execution Vulnerability

CWE(s)

Related Threats

MITRE ATT&CK Enterprise Techniques

T1003 OS Credential Dumping Credential Access
Adversaries may attempt to dump credentials to obtain account login and credential material, normally in the form of a hash or a clear text password.
T1212 Exploitation for Credential Access Credential Access
Adversaries may exploit software vulnerabilities in an attempt to collect credentials.
T1552 Unsecured Credentials Credential Access
Adversaries may search compromised systems to find and obtain insecurely stored credentials.
Derived from this CVE’s CWE(s) via the direct CWE→ATT&CK cross-walk.

CVEs Like This One

CVE-2025-33070Same vendor: Microsoft
CVE-2025-27474Same vendor: Microsoft
CVE-2023-24941Same vendor: Microsoft
CVE-2023-36913Same vendor: Microsoft
CVE-2023-36012Same vendor: Microsoft
CVE-2023-36704Same vendor: Microsoft
CVE-2024-38257Same vendor: Microsoft
CVE-2026-50376Same vendor: Microsoft
CVE-2008-0081Same vendor: Microsoft
CVE-2026-50690Same vendor: Microsoft

Affected Assets

microsoft
host integration server
2020
microsoft
ole db provider
7.0

Mitigating Controls

Mitigating Controls (NIST CSF 2.0) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→CSF cross-walk (authority under review) — links open the control.

PR.PS-06 mostly match
prevents

Secure SDLC activities such as static analysis and code review directly prevent use of uninitialized resources while also addressing many other weaknesses.

Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI

Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.

finds

Security testing in development and acceptance can detect uninitialized resource usage through dynamic analysis and fuzzing.

prevents

Secure development life cycle mandates initialization checks and static analysis that can catch uninitialized resource use.

prevents

Application security requirements can specify mandatory initialization of variables and resources before use.

prevents

Secure system architecture and engineering principles include defensive coding practices that prevent use of uninitialized memory or objects.

prevents

Secure coding standards directly require explicit initialization of all variables and resources, substantially mitigating CWE-908.

References