Lucene search

MicrosoftCVE-2016-3373

HistorySep 14, 2016 - 10:59 a.m.

CVE-2016-3373

2016-09-1410:59:48

CWE-264

microsoft

web.nvd.nist.gov

microsoft windows

kernel api

vulnerability

registry access control

local user

sensitive account information

nvd

cve-2016-3373

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

CVSS3

5.5

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

5.6

Confidence

High

EPSS

0.003

Percentile

65.6%

JSON

The kernel API in Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 does not properly implement registry access control, which allows local users to obtain sensitive account information via a crafted application, aka “Windows Kernel Elevation of Privilege Vulnerability.”

Affected configurations

Nvd

Node

microsoftwindows_10Match-

microsoftwindows_10Match1511

microsoftwindows_10Match1607

microsoftwindows_7sp1

microsoftwindows_8.1

microsoftwindows_rt_8.1

microsoftwindows_server_2008sp2

microsoftwindows_server_2008Matchr2sp1

microsoftwindows_server_2012Match-

microsoftwindows_server_2012Matchr2

microsoftwindows_vistasp2

VendorProductVersionCPE
microsoftwindows_10-cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
microsoftwindows_101511cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*
microsoftwindows_101607cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
microsoftwindows_7*cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
microsoftwindows_8.1*cpe:2.3:o:microsoft:windows_8.1:*:*:*:*:*:*:*:*
microsoftwindows_rt_8.1*cpe:2.3:o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*
microsoftwindows_server_2008*cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
microsoftwindows_server_2008r2cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
microsoftwindows_server_2012-cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
microsoftwindows_server_2012r2cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_10	-	cpe:2.3:o:microsoft:windows_10:-:::::::*
microsoft	windows_10	1511	cpe:2.3:o:microsoft:windows_10:1511:::::::*
microsoft	windows_10	1607	cpe:2.3:o:microsoft:windows_10:1607:::::::*
microsoft	windows_7	*	cpe:2.3:o:microsoft:windows_7::sp1::::::*
microsoft	windows_8.1	*	cpe:2.3:o:microsoft:windows_8.1::::::::
microsoft	windows_rt_8.1	*	cpe:2.3:o:microsoft:windows_rt_8.1::::::::
microsoft	windows_server_2008	*	cpe:2.3:o:microsoft:windows_server_2008::sp2::::::*
microsoft	windows_server_2008	r2	cpe:2.3:o:microsoft:windows_server_2008:r2:sp1::::::
microsoft	windows_server_2012	-	cpe:2.3:o:microsoft:windows_server_2012:-:::::::*
microsoft	windows_server_2012	r2	cpe:2.3:o:microsoft:windows_server_2012:r2:::::::*