Vulnerabilitymedium

Microsoft enforces defenses preventing NTLM relay attacks

Help Net Securityby @zeljkazorzDec 11, 2024 · 00:00 UTC (Dec 11, 2024)2 min read3 · 1 read

Read at helpnetsecurity.com

Analyze CVE-2024-21413 with Vani AIImpact, affected versions, exploitation, mitigations and detection

CVEs: CVE-2024-21413 CVE-2023-23397 CVE-2023-36563

Tags: cve-2024-21413 cve-2023-23397 cve-2023-36563 vulnerability

Vulnerabilities mentioned

All

CVE	Vulnerability	CVSS	EPSS	Signals	Published
CVE-2023-23397	Zero-Click Elevation of Privilege in Microsoft Outlook (Forced NTLM Credential Leak)	9.8	97%	KEV	Mar 14, 2023 KEV Mar 14, 2023
CVE-2023-36563	Information Disclosure in Microsoft WordPad Exploited in the Wild	5.5	20%	KEV	Oct 10, 2023 KEV Oct 10, 2023
CVE-2024-21413	Improper Input Validation RCE in Microsoft Outlook (MonikerLink)	9.8	95%	KEVPoC	Feb 13, 2024 KEV Feb 6, 2025

From the original article

2 min read at helpnetsecurity.com

Since making Kerberos the default Windows authentication protocol in 2000, Microsoft has been working on eventually retiring NTLM, its less secure and obsolete counterpart. Until NTLM gets disabled by default, Microsoft is working on shoring up defenses against NTLM relay attacks.

Help Net Security

By @zeljkazorz · helpnetsecurity.com

Read the full article at Help Net Security

A short excerpt; the article and its images belong to the publisher. Summary, key facts and assessment above are AI-written from the article and can be wrong.