Описание
Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability
FAQ
What should I do to be protected against this vulnerability?
In addition to applying the updates in this CVE, you will need to disable NTLM as per the guidance as follows:
For Azure Active Directory Connect, see Prerequisites for Azure AD Connect For Azure Active Directory Connect Provisioning Agent, see Prerequisites for Azure AD Connect cloud sync
What must an attacker do to exploit this vulnerability
The attacker must be able to establish Man-in-the-middle between your Azure AD Connect server and a domain controller. The attacker also needs to possess domain user credentials to be able to exploit this vulnerability.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Microsoft Azure Active Directory Connect 2.0.X.Y | ||
| Microsoft Azure Active Directory Connect 1.X.Y.Z | ||
| Azure Active Directory Connect Provisioning Agent |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
Older Software Release
DOS
EPSS
7.1 High
CVSS3
Связанные уязвимости
Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability
Microsoft Azure Active Directory Connect Authentication Bypass Vulnerability
Уязвимость программных средств облачной платформы Azure Active Directory Connect Provisioning Agent и Azure Active Directory Connect, связанная с недостатками механизма аутентификации, позволяющая нарушителю обойти механизмы безопасности
EPSS
7.1 High
CVSS3