PT-2021-5017 · Microsoft · Active Directory Domain Services+1

Andrew Bartlett · Published 2021-11-09 · Updated 2026-03-10 · CVE-2021-42291

Positive Technologies (AI Summary)

CVSS v2.0

9.0

High

Base vector

AV:N/AC:L/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Active Directory Domain Services (affected versions not specified)

Description The issue is related to insecure privilege management in the Active Directory Domain Services component of the Windows operating system. This allows a remote attacker to potentially elevate their privileges. The vulnerability can be exploited by an attacker to affect the system. In certain configurations, such as when an Owner has rights on the DC object and without specific protections in place, the Owner can grant themselves or others any desired rights via implicit WriteDACL.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2021-05784

CVE-2021-42291

Affected Products

Active Directory Domain Services

Windows

References · 9

• https://osv.dev/vulnerability/CVE-2021-42291 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-42291 · Security Note
• https://bdu.fstec.ru/vul/2021-05784 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-42291 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-42291 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-42291 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-42291 · Vendor Advisory
• https://cybersecurity-help.cz/vdb/SB2021110914 · Note
• https://twitter.com/JimSycurity/status/1760315511475249249 · Twitter Post