CVE-2024-20655

EUVD-2024-18370
Microsoft Online Certificate Status Protocol (OCSP) Remote Code Execution Vulnerability
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTPrimary
6.6 MEDIUM
NETWORK
HIGH
HIGH
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H
microsoftCNA
6.6 MEDIUM
CVSS:3.1/AV:N/AC:H/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Base Score
CVSS 3.x
EPSS Score
Percentile: 61%
Affected Products (NVD)
VendorProductVersion
microsoftwindows_server_2008
-
microsoftwindows_server_2008
-
microsoftwindows_server_2012
-
microsoftwindows_server_2016
-
microsoftwindows_server_2019
-
microsoftwindows_server_2022
-
microsoftwindows_server_2022_23h2
-
𝑥
= Vulnerable software versions
Windows Releases
Platform
Version
Windows Server 2008
Service Pack 2 (x64, x86)
KB5034176
Service Pack 2 Server Core (x64, x86)
KB5034176
Windows Server 2008 R2
Service Pack 1 (x64)
KB5034169
Service Pack 1 Server Core (x64)
KB5034169
Windows Server 2012
Server Core
KB5034184
Standard
KB5034184
Windows Server 2012 R2
Server Core
KB5034171
Standard
KB5034171
Windows Server 2016
Server Core
KB5034119
Standard
KB5034119
Windows Server 2019
Server Core
KB5034127
Standard
KB5034127
Windows Server 2022
23H2 Server Core
KB5034130
Server Core
KB5034129
Standard
KB5034129
Common Weakness Enumeration
References
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20655
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20655