PT-2021-6253 · Microsoft · Local Security Authority (Lsa) Server+2

Edwardzpeng + 3 · Published 2021-12-14 · Updated 2023-12-28 · CVE-2021-43216

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Local Security Authority (LSA) Server (affected versions not specified)

Description The issue is related to an information disclosure vulnerability in the Microsoft Local Security Authority Subsystem Service (LSASS) of the Microsoft Windows operating system. This vulnerability can be exploited by a remote attacker to disclose protected information. The vulnerability is associated with an error in the data area, which can lead to the exposure of sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exposure of Resource to Wrong Sphere

Weakness Enumeration

CWE-688

CWE-668

Related Identifiers

BDU:2022-01191

CVE-2021-43216

Affected Products

Lsass

Local Security Authority (Lsa) Server

Windows

References · 9

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-43216 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2021-43216 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-43216 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2021-43216 · Vendor Advisory
• https://bdu.fstec.ru/vul/2022-01191 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-43216 · Security Note
• https://osv.dev/vulnerability/CVE-2021-43216 · Vendor Advisory
• https://t.me/cibsecurity/34019 · Telegram Post
• https://t.me/cvenotify/24752 · Telegram Post