Use of Uninitialized Resource (CWE-908)
Microsoft Local Security Authority (LSA) Server Information Disclosure Vulnerability. This vulnerability allows an attacker with low privileges to potentially access sensitive information. It is related to the use of an uninitialized resource (CWE-908) in the Local Security Authority (LSA) Server component of various Microsoft Windows versions.
If exploited, this vulnerability could lead to the disclosure of sensitive information. An attacker who successfully exploits this vulnerability could gain unauthorized access to confidential data stored or processed by the Local Security Authority (LSA) Server. This could potentially compromise user credentials, security tokens, or other sensitive system information, leading to further system compromise or privilege escalation.
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patches are available. Microsoft has released updates to address this vulnerability across multiple affected Windows versions. These include Windows 10 (various versions), Windows 11 (various versions), Windows Server 2008, 2012, 2016, 2019, and 2022.
1. Apply the latest security updates provided by Microsoft for the affected Windows versions. 2. Ensure that only trusted users have local access to systems, as the attack vector is local. 3. Implement the principle of least privilege to minimize the potential impact of successful exploitation. 4. Monitor system logs for any suspicious activities related to the Local Security Authority (LSA) Server. 5. Keep all Windows systems up to date with the latest security patches as a general best practice.
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Detection for the vulnerability has been added to Qualys (92160)
A CVSS base score of 5.5 has been assigned.
Feedly found the first article mentioning CVE-2024-38122. See article
Feedly estimated the CVSS score as MEDIUM
NVD published the first details for CVE-2024-38122
EPSS Score was set to: 0.04% (Percentile: 10.9%)