CVE-2022-24545

HighCVSS 8.1/10Last modified Oct 8, 2026

Description

Windows Kerberos Remote Code Execution Vulnerability

Metrics

CVSS 3.1 8.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H

Affected software

VendorProductVersions
MicrosoftWindows 10 Version 1809>= 10.0.17763.0, < 10.0.17763.2803
MicrosoftWindows 10 Version 1809>= 10.0.0, < 10.0.17763.2803
MicrosoftWindows Server 2019>= 10.0.17763.0, < 10.0.17763.2803
MicrosoftWindows Server 2019 (Server Core installation)>= 10.0.17763.0, < 10.0.17763.2803
MicrosoftWindows 10 Version 1909>= 10.0.0, < 10.0.18363.2212
MicrosoftWindows 10 Version 21H1>= 10.0.0, < 10.0.19043.1645
MicrosoftWindows Server 2022>= 10.0.20348.0, < 10.0.20348.643
MicrosoftWindows 10 Version 20H2>= 10.0.0, < 10.0.19042.1645
MicrosoftWindows Server version 20H2>= 10.0.0, < 10.0.19042.1645
MicrosoftWindows 11 version 21H2>= 10.0.0, < 10.0.22000.613
MicrosoftWindows 10 Version 21H2>= 10.0.19043.0, < 10.0.19044.1645
MicrosoftWindows 10 Version 1607>= 10.0.14393.0, < 10.0.14393.5066
MicrosoftWindows Server 2016>= 10.0.14393.0, < 10.0.14393.5066
MicrosoftWindows Server 2016 (Server Core installation)>= 10.0.14393.0, < 10.0.14393.5066

References

Timeline

Published
Apr 15, 2022
Last modified
Oct 8, 2026
NVD status
Modified

Related CVEs from 2022

CVE-2022-245467.8Windows DWM Core Library Elevation of Privilege VulnerabilityCVE-2022-245477.8Windows Digital Media Receiver Elevation of Privilege VulnerabilityCVE-2022-245485.5Microsoft Defender Denial of Service VulnerabilityCVE-2022-245497.8Windows AppX Package Manager Elevation of Privilege VulnerabilityCVE-2022-24556.5A business logic issue in the handling of large repositories in all versions of GitLab CE/EE from 10.0 before 15.1.6, all versions starting CVE-2022-245507.8Windows Telephony Server Elevation of Privilege VulnerabilityCVE-2022-245518.8A flaw was found in StarWind Stack. The endpoint for setting a new password doesn’t check the current username and old password. An attackerCVE-2022-245529.8A flaw was found in the REST API in StarWind Stack. REST command, which manipulates a virtual disk, doesn’t check input parameters. Some of CVE-2022-245539.8An issue was found in Zfaka <= 1.4.5. The verification of the background file upload function check is not strict, resulting in remote commaCVE-2022-24562.7An issue has been discovered in GitLab CE/EE affecting all versions before 15.0.5, all versions starting from 15.1 before 15.1.4, all versioCVE-2022-245629.8In IOBit IOTransfer 4.3.1.1561, an unauthenticated attacker can send GET and POST requests to Airserv and gain arbitrary read/write access tCVE-2022-245635.4In Genixcms v1.1.11, a stored Cross-Site Scripting (XSS) vulnerability exists in /gxadmin/index.php?page=themes&view=options" via the intro_
CVE-2022-24545: High severity, CVSS 8.1 | Vulnix