CVE-2024-43532 - Not Failing Securely ('Failing Open')

Severity

88%

Complexity

27%

Confidentiality

98%

Remote Registry Service Elevation of Privilege Vulnerability

CVSS 3.1 Base Score 8.8. CVSS Attack Vector: network. CVSS Attack Complexity: low. CVSS Vector: (CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H).

Demo Examples

Not Failing Securely ('Failing Open')

CWE-636

Switches may revert their functionality to that of hubs when the table used to map ARP information to the switch interface overflows, such as when under a spoofing attack. This results in traffic being broadcast to an eavesdropper, instead of being sent only on the relevant switch interface. To mitigate this type of problem, the developer could limit the number of ARP entries that can be recorded for a given switch interface, while other interfaces may keep functioning normally. Configuration options can be provided on the appropriate actions to be taken in case of a detected failure, but safe defaults should be used.

Overview

Type

Microsoft Windows Server

First reported 4 months ago

2024-10-08 18:15:00

Last updated 4 months ago

2024-10-16 21:51:00

Affected Software

Microsoft Windows Server 2012

Microsoft Windows Server 2016

Microsoft Windows Server 2019

References

Remote Registry Service Elevation of Privilege Vulnerability

Remote Registry Service Elevation of Privilege Vulnerability

Patch, Vendor Advisory

Stay updated

ExploitPedia is constantly evolving. Sign up to receive a notification when we release additional functionality.

Get in touch

If you'd like to report a bug or have any suggestions for improvements then please do get in touch with us using this form. We will get back to you as soon as we can.