CVE-2023-36802KEV · OVERDUECWE-416

Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

High · published September 12, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 98.1th percentile for exploit probability.

1116
days past CISA
deadline
CVSS v3.1
7.8
EPSS
28%
Percentile
98.1
In the wild
Confirmed
What it is

⚡ A crafty attacker could exploit this vulnerability to escalate privileges within your system! 🚨 Think of it like a sneaky intruder who finds an unguarded service entrance to an exclusive party, gaining access to areas they shouldn't and throwing a wrench in the whole operation! An attacker leveraging this flaw could elevate their privileges, allowing them to execute malicious code and potentially compromise sensitive data. This could lead to system takeover, unauthorized access to user accounts, and significant data breaches that are absolutely devastating.

Put simply

Think of it like a sneaky intruder who finds an unguarded service entrance to an exclusive party, gaining access to areas they shouldn't and throwing a wrench in the whole operation! This vulnerability in Microsoft Streaming Service Proxy allows an attacker to gain elevated privileges by exploiting improper validation, enabling them to execute malicious actions as an admin.

What to do

An attacker leveraging this flaw could elevate their privileges, allowing them to execute malicious code and potentially compromise sensitive data. This could lead to system takeover, unauthorized access to user accounts, and significant data breaches that are absolutely devastating. Immediately apply patches released by Microsoft for this vulnerability. Review and restrict access to the Streaming Service Proxy, and monitor system logs for any unusual activity or unauthorized access attempts. You've got this! By taking these steps, you'll keep your systems safe and secure! 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.27909 · 98.1th percentile
Weakness
CWE-416 · Use After Free
Published
2023-09-12T16:58Z
KEV added
2023-09-12 · due 2023-10-03
EPSS history
Timeline
  • 12 SEP 16:58Z
    Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability
    cvelistv5
  • 12 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 3
    kev