CVE-2024-49019
Published: Nov 12, 2024

010
CVSS 7.8EPSS 0.04%High
CVE info copied to clipboard

Summary

Active Directory Certificate Services Elevation of Privilege Vulnerability. This is a local vulnerability with a CVSS base score of 7.8, indicating a high severity. The vulnerability has high impacts on confidentiality, integrity, and availability. It requires low privileges and no user interaction to exploit. The attack complexity is low, but it requires local access.

Impact

If exploited, this vulnerability could allow an attacker with low privileges to elevate their privileges on the system. Given the high impact on confidentiality, integrity, and availability, a successful attack could potentially lead to unauthorized access to sensitive information, modification of critical data, and disruption of Active Directory Certificate Services. This could compromise the security of the entire Active Directory infrastructure, affecting authentication, authorization, and secure communication within the network.

Exploitation

There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.

Patch

A patch is available. Microsoft released a patch on November 12, 2024.

Mitigation

1. Apply the security update provided by Microsoft as soon as possible. 2. Limit local access to systems running Active Directory Certificate Services to trusted users only. 3. Monitor for suspicious activities related to Active Directory Certificate Services. 4. Implement the principle of least privilege for user accounts. 5. Regularly audit and review Active Directory Certificate Services configurations and permissions. 6. Consider implementing additional access controls and network segmentation to limit the potential impact of the vulnerability.

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

Timeline

Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (92186)

Nov 12, 2024 at 7:53 AM
CVSS

A CVSS base score of 7.8 has been assigned.

Nov 12, 2024 at 5:55 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-49019. See article

Nov 12, 2024 at 5:59 PM / #cybersecurity
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Nov 12, 2024 at 5:59 PM
CVE Assignment

NVD published the first details for CVE-2024-49019

Nov 12, 2024 at 6:15 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Nov 12, 2024 at 6:36 PM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.1%)

Nov 13, 2024 at 4:10 PM
Threat Intelligence Report

CVE-2024-49019 is a critical elevation of privilege vulnerability affecting Active Directory Certificate Services. The details regarding its CVSS score, exploitation in the wild, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors are not provided in the available information. Further investigation is needed to assess the full implications and available defenses against this vulnerability. See article

Nov 14, 2024 at 6:08 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 10.2%)

Nov 18, 2024 at 8:23 PM
Static CVE Timeline Graph

Affected Systems

Microsoft/windows_server_2008
+null more

Patches

Microsoft
+null more

References

Active Directory Certificate Services Elevation of Privilege Vulnerability
What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain domain administrator privileges.
ION Advisory: November Patch Tuesday
None of the following critical vulnerabilities below have been reported as being actively exploited or publicly disclosed: The following vulnerabilities have been reported as publicly disclosed, but not yet actively exploited :

News

Active Directory Certificate Services Elevation of Privilege Vulnerability
What privileges could be gained by an attacker who successfully exploited the vulnerability? An attacker who successfully exploited this vulnerability could gain domain administrator privileges.
Microsoft Vulnerability Poses Risk to Domain Control
A recently disclosed flaw in Microsoft Active Directory Certificate Services (ADCS), identified as CVE-2024-49019, could allow attackers to escalate privileges and gain control of a domain. The vulnerability, rated with a CVSS score of 7.8, is classified as an elevation-of-privilege (EoP) issue. If exploited, attackers could potentially obtain domain administrator privileges, compromising the security of […] This article has been indexed from Information Security Buzz Read the original article: Microsoft Vulnerability Poses Risk to Domain Control The post Microsoft Vulnerability Poses Risk to Domain Control appeared first on IT Security News .
Microsoft Vulnerability Poses Risk to Domain Control
Microsoft’s advisory shares several ways entities can mitigate the risks, including removing excessive enrollment rights for users or groups, eliminating unused certificate templates, and securing templates that allow users to specify a subject in the request. A recently disclosed flaw in Microsoft Active Directory Certificate Services (ADCS), identified as CVE-2024-49019, could allow attackers to escalate privileges and gain control of a domain.
2024-45 - Adobe, Mozilla, Canonical, Red Hat, Microsoft, Google, Jenkins, GitHub, Spring 🗂️
Advisory Week Week 45, 2024 National Cyber Awareness System CISA Releases Nineteen Industrial Control Systems Advisories CISA Adds Two Known Exploited Vulnerabilities to Catalog Palo Alto Networks Emphasizes Hardening Guidance Fortinet Releases Security Updates for Multiple Products Microsoft Releases November 2024 Security Updates Adobe Releases Security Updates for Multiple Products Ivanti Releases Security Updates for Multiple Products JCDC’s Collaborative Efforts Enhance Cybersecurity for the 2024 Olympic and Paralympic Games Citrix Releases Security Updates for NetScaler and Citrix Session Recording CISA Releases Five Industrial Control Systems Advisories CISA, FBI, NSA, and International Partners Release Joint Advisory on 2023 Top Routinely Exploited Vulnerabilities CISA Adds Five Known Exploited Vulnerabilities to Catalog Adobe Security Bulletins and Advisories Security updates available for Adobe Photoshop APSB24-89 Security Updates Available for Adobe Commerce APSB24-90 Security Updates Available for Adobe Illustrator APSB24-66 APSB24-87 Security Update Available for Adobe InDesign APSB24-88 Security Updates Available for Adobe Bridge APSB24-77 Security Updates Available for Adobe Audition APSB24-83 Mozilla Security Advisories Security Vulnerabilities fixed in Thunderbird 132.0.1 mfsa2024-62 Security Vulnerabilities fixed in Thunderbird 128.4.3 mfsa2024-61 Ubuntu Security Notices Linux kernel vulnerabilities: USN-7089-6 / USN-7088-5 / USN-7089-5 / USN-7110-1 / USN-7089-4 / USN-7100-2 / USN-7100-1 GD Graphics Library vulnerability: USN-7112-1 Go vulnerabilities: USN-7111-1 / USN-7109-1 Linux kernel vulnerability:
Security & Threat Updates – November 2024:
Microsoft addressed 89 Common Vulnerabilities and Exposures (CVE’s) this month, 6 which were marked as zero-day vulnerabilities. The most critical Common Vulnerabilities and Exposures (CVE’s) are noted below:
See 116 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Unchanged
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI