Windows Encrypting File System (EFS) Elevation of Privilege Vulnerability

The remote Windows host is missing security update 5008285 or cumulative update 5008263. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-40441, CVE-2021-41333, CVE-2021-43207,     CVE-2021-43223, CVE-2021-43226, CVE-2021-43229,     CVE-2021-43230, CVE-2021-43238, CVE-2021-43245,     CVE-2021-43248, CVE-2021-43883, CVE-2021-43893)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43232, CVE-2021-43233,     CVE-2021-43234)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43236)

The remote Windows host is missing security update 5008206.
It is, therefore, affected by multiple vulnerabilities:

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-43219,     CVE-2021-43228, CVE-2021-43246)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43232, CVE-2021-43233,     CVE-2021-43234)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43227, CVE-2021-43235,     CVE-2021-43236, CVE-2021-43244)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43223,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43231, CVE-2021-43237, CVE-2021-43238,     CVE-2021-43240, CVE-2021-43247, CVE-2021-43248,     CVE-2021-43883, CVE-2021-43893)

The Windows 10 1809 / Windows Server 2019 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43223,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43231, CVE-2021-43237, CVE-2021-43238,     CVE-2021-43239, CVE-2021-43240, CVE-2021-43247,     CVE-2021-43248, CVE-2021-43880, CVE-2021-43883,     CVE-2021-43893)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43227, CVE-2021-43235,     CVE-2021-43236)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-43219,     CVE-2021-43228)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43217,     CVE-2021-43232, CVE-2021-43233, CVE-2021-43234)

The remote Windows host is missing security update 5008230. It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43232, CVE-2021-43233,     CVE-2021-43234)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43227, CVE-2021-43235,     CVE-2021-43236)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43223,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43238, CVE-2021-43248, CVE-2021-43883,     CVE-2021-43893)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The remote Windows host is missing security update 5008282 or cumulative update 5008244. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-40441, CVE-2021-41333, CVE-2021-43207,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43238, CVE-2021-43245, CVE-2021-43883,     CVE-2021-43893)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43233, CVE-2021-43234)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43236)

The Windows 11 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43223,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43231, CVE-2021-43237, CVE-2021-43238,     CVE-2021-43239, CVE-2021-43240, CVE-2021-43247,     CVE-2021-43248, CVE-2021-43880, CVE-2021-43883,     CVE-2021-43893)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43227, CVE-2021-43235,     CVE-2021-43236)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-43219,     CVE-2021-43228)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43217,     CVE-2021-43232, CVE-2021-43233, CVE-2021-43234)

The remote Windows host is missing security update 5008271 or cumulative update 5008274. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43226,     CVE-2021-43229, CVE-2021-43230, CVE-2021-43238,     CVE-2021-43883, CVE-2021-43893)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43236)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43234)

The Windows Server 2022 installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43223,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43231, CVE-2021-43237, CVE-2021-43238,     CVE-2021-43239, CVE-2021-43240, CVE-2021-43247,     CVE-2021-43248, CVE-2021-43880, CVE-2021-43883,     CVE-2021-43893)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43227, CVE-2021-43235,     CVE-2021-43236)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-43219,     CVE-2021-43228)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43217,     CVE-2021-43232, CVE-2021-43233, CVE-2021-43234)

The remote Windows host is missing security update 5008212.
It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43223,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43231, CVE-2021-43237, CVE-2021-43238,     CVE-2021-43239, CVE-2021-43240, CVE-2021-43247,     CVE-2021-43248, CVE-2021-43883, CVE-2021-43893)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43232, CVE-2021-43233,     CVE-2021-43234)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43227, CVE-2021-43235,     CVE-2021-43236, CVE-2021-43244)

  - A denial of service (DoS) vulnerability. An attacker can     exploit this issue to cause the affected component to     deny system or application services. (CVE-2021-43219,     CVE-2021-43228, CVE-2021-43246)

The remote Windows host is missing security update 5008255 or cumulative update 5008277. It is, therefore, affected by multiple vulnerabilities:

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-40441, CVE-2021-41333, CVE-2021-43207,     CVE-2021-43223, CVE-2021-43226, CVE-2021-43229,     CVE-2021-43230, CVE-2021-43238, CVE-2021-43245,     CVE-2021-43248, CVE-2021-43883, CVE-2021-43893)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43232, CVE-2021-43233,     CVE-2021-43234)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43236)

The remote Windows host is missing security update 5008207.
It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-43215,     CVE-2021-43217, CVE-2021-43232, CVE-2021-43233,     CVE-2021-43234)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2021-43216, CVE-2021-43222,     CVE-2021-43224, CVE-2021-43227, CVE-2021-43235,     CVE-2021-43236)

  - An elevation of privilege vulnerability. An attacker can     exploit this to gain elevated privileges.
    (CVE-2021-41333, CVE-2021-43207, CVE-2021-43223,     CVE-2021-43226, CVE-2021-43229, CVE-2021-43230,     CVE-2021-43231, CVE-2021-43238, CVE-2021-43248,     CVE-2021-43883, CVE-2021-43893)

ID	Name	Product	Family	Severity
156073	KB5008285: Windows 8.1 and Windows Server 2012 R2 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156072	KB5008206: Windows 10 Version 1909 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156071	KB5008218: Windows 10 version 1809 / Windows Server 2019 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156070	KB5008230: Windows 10 version 1507 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156069	KB5008282: Windows 7 and Windows Server 2008 R2 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156068	KB5008215: Windows 11 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156067	KB5008271: Windows Server 2008 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156066	KB5008223: Windows Server 2022 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156065	KB5008212: Windows 10 Version 2004 / Windows 10 Version 20H2 / Windows 10 Version 21H1 / Windows 10 Version 21H2 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156064	KB5008255: Windows Server 2012 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical
156063	KB5008207: Windows 10 Version 1607 and Windows Server 2016 Security Update (December 2021)	Nessus	Windows : Microsoft Bulletins	critical

Detections

Analytics

CVE-2021-43893

high

Tenable Plugins

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical

critical