CVEvulnerability

CVE-2016-3352

8.8 HIGH Published 2016-09-14 Modified 2026-06-17 Official page ↗
Status
Modified
Published
2016-09-14
Last modified
2026-06-17
Assigner
[email protected]
CVSS 3.0 ([email protected])
8.8 HIGH — CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-285

Description

Microsoft Windows 8.1, Windows RT 8.1, and Windows 10 Gold, 1511, and 1607 do not properly check NTLM SSO requests for MSA logins, which makes it easier for remote attackers to determine passwords via a brute-force attack on NTLM password hashes, aka "Microsoft Information Disclosure Vulnerability."

Affected configurations

• microsoft windows 10 • microsoft windows 10 1511 • microsoft windows 10 1607 • microsoft windows 8.1 • microsoft windows rt 8.1

Related

Weakness · CWE (1)

  • CWE-285 Improper Authorization weakness

References