Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12431
HistoryJan 21, 2022 - 12:00 a.m.

KLA12431 RCE vulnerability in Microsoft Windows

2022-01-2100:00:00
Kaspersky Lab
threats.kaspersky.com
89

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

8.6 High

AI Score

Confidence

High

0.742 High

EPSS

Percentile

98.1%

JSON

Remote code execution vulnerability was found in Microsoft Windows. Malicious users can exploit this vulnerability to execute arbitrary code.

Original advisories

CVE-2013-3900

Exploitation

Public exploits exist for this vulnerability.

Related products

Microsoft-Windows

Microsoft-Windows-Server

Microsoft-Windows-Server-2012

Microsoft-Windows-8

Windows-RT

Microsoft-Windows-10

Microsoft-Windows-Server-2016

Microsoft-Windows-Server-2019

CVE list

CVE-2013-3900 high

KB list

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Impacts

  • ACE

Arbitrary code execution. Exploitation of vulnerabilities with this impact can lead to executing by abuser any code or commands at vulnerable machine or process.

  • PE

Privilege escalation. Exploitation of vulnerabilities with this impact can lead to performing by abuser actions, which are normally disallowed for current role.

Affected Products

  • Windows Server 2022Windows 10 Version 1809 for ARM64-based SystemsWindows 11 for ARM64-based SystemsWindows Server 2012Windows 10 Version 21H1 for ARM64-based SystemsWindows 10 Version 1909 for x64-based SystemsWindows Server 2019Windows Server 2016Windows 10 Version 21H1 for x64-based SystemsWindows 8.1 for 32-bit systemsWindows 10 Version 21H1 for 32-bit SystemsWindows Server 2012 R2Windows 8.1 for x64-based systemsWindows 10 Version 20H2 for x64-based SystemsWindows 11 for x64-based SystemsWindows 10 Version 21H2 for 32-bit SystemsWindows 10 Version 1909 for 32-bit SystemsWindows 10 for x64-based SystemsWindows 10 Version 1607 for 32-bit SystemsWindows 10 Version 1607 for x64-based SystemsWindows 10 Version 21H2 for ARM64-based SystemsWindows 10 Version 20H2 for 32-bit SystemsWindows 10 Version 1809 for 32-bit SystemsWindows 10 Version 20H2 for ARM64-based SystemsWindows 10 Version 1809 for x64-based SystemsWindows 10 for 32-bit SystemsWindows 10 Version 1909 for ARM64-based SystemsWindows 10 Version 21H2 for x64-based SystemsWindows RT 8.1

Related

kaspersky 1
nvd 1
openvas 2
checkpoint_advisories 3
symantec 1
attackerkb 1
cisa_kev 1
mscve 1
thn 4
cvelist 1
nessus 2
cve 1
prion 1
threatpost 2
mmpc 1
mssecure 1
securityvulns 1
avleonov 1
qualysblog 2
cisa 1
kaspersky
kaspersky
KLA12432 RCE vulnerability in Microsoft Products (ESU)
2022-01-21 00:00:00
nvd
nvd
CVE-2013-3900
2013-12-11 00:55:03
openvas
openvas
Microsoft WinVerifyTrust Signature Validation Vulnerability (2893294)
2013-12-11 00:00:00
Microsoft WinVerifyTrust Signature Validation Vulnerability (2893294)
2013-12-11 00:00:00
checkpoint_advisories
checkpoint_advisories
Portable Executable Files With Weak Encryption (CVE-2013-3900)
2013-12-10 00:00:00
Microsoft Windows WinVerifyTrust PE Validation Security Bypass (MS13-098; CVE-2013-3900)
2014-01-20 00:00:00
Microsoft Windows WinVerifyTrust Signature Validation Code Execution (MS13-098; CVE-2013-3900)
2013-12-10 00:00:00
symantec
symantec
Microsoft Windows CVE-2013-3900 Remote Code Execution Vulnerability
2013-12-10 00:00:00
attackerkb
attackerkb
CVE-2013-3900
2013-12-11 00:00:00
cisa_kev
cisa_kev
Microsoft WinVerifyTrust function Remote Code Execution
2022-01-10 00:00:00
mscve
mscve
WinVerifyTrust Signature Validation Vulnerability
2022-01-21 08:00:00
thn
thn
New Zloader Banking Malware Campaign Exploiting Microsoft Signature Verification
2022-01-05 11:00:00
Cryptocurrency Companies Targeted in Sophisticated 3CX Supply Chain Attack
2023-04-04 03:54:00
Urgent: Microsoft Issues Patches for 97 Flaws, Including Active Ransomware Exploit
2023-04-12 06:38:00
cvelist
cvelist
CVE-2013-3900
2013-12-11 00:00:00
nessus
nessus
WinVerifyTrust Signature Validation CVE-2013-3900 Mitigation (EnableCertPaddingCheck)
2022-10-26 00:00:00
MS13-098: Vulnerability in Windows Could Allow Remote Code Execution (2893294)
2013-12-11 00:00:00
cve
cve
CVE-2013-3900
2013-12-11 00:55:03
prion
prion
Input validation
2013-12-11 00:55:00
threatpost
threatpost
Skeletons in the Closet: Security 101 Takes a Backseat to 0-days
2022-04-22 10:56:16
No Critical Bugs for Microsoft February 2022 Patch Tuesday, 1 Zero-Day
2022-02-08 20:24:17
mmpc
mmpc
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware
2022-04-13 16:00:00
mssecure
mssecure
Dismantling ZLoader: How malicious ads led to disabled security tools and ransomware
2022-04-13 16:00:00
securityvulns
securityvulns
Microsoft Windows multiple security vulnerabilities
2013-12-30 00:00:00
avleonov
avleonov
Microsoft Patch Tuesday February 2022
2022-02-28 20:52:10
qualysblog
qualysblog
Microsoft and Adobe Patch Tuesday, May 2023 Security Update Review
2023-05-09 21:24:08
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00
cisa
cisa
CISA Adds 15 Known Exploited Vulnerabilities to Catalog
2022-01-10 00:00:00

7.6 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

HIGH

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:H/Au:N/C:C/I:C/A:C

8.6 High

AI Score

Confidence

High

0.742 High

EPSS

Percentile

98.1%

JSON
Related for KLA12431
kaspersky1nvd1openvas2checkpoint_advisories3symantec1attackerkb1cisa_kev1mscve1thn4cvelist1nessus2cve1prion1threatpost2mmpc1mssecure1securityvulns1avleonov1qualysblog2cisa1