Permissions, Privileges, and Access Controls in Microsoft Windows and Windows Server - CVE-2021-34484

Vulnerability identifier: #VU55695

CSH Severity: Low

CVSS v4: 8.5 [CVSS:4.0/AV:L/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2021-34484

CWE-ID: CWE-264

Exploitation vector: Local access

Exploit availability: The vulnerability is being exploited in the wild

The vulnerability allows a local user to escalate privileges on the system.

The vulnerability exists due to application does not properly impose security restrictions in the Windows User Profile Service, which leads to security restrictions bypass and privilege escalation.

Microsoft Windows
Windows Server
Solutions Enabler Virtual Appliance
Solutions Enabler
Unisphere for PowerMax Virtual Appliance
Unisphere for PowerMax

Install updates from vendor's website.

Microsoft Windows - addressed in versions 10, 10 S, 10 20H2 10.0.19042.572, 10 21H1 10.0.19043.985, 10 Gold, 10 Mobile, 10 1507 10.0.10240.16405, 10 1511 10.0.10586.3, 10 1607 10.0.14393.10, 10 1703 10.0.15063.138, 10 1709 10.0.16299.19, 10 1803 10.0.17134.48, 10 1809 10.0.17763.1, 10 1903 10.0.18362.116, 10 1909 10.0.18363.476, 10 2004 10.0.19041.264
Solutions Enabler Virtual Appliance - addressed in versions 9.1.0.17, 9.2.2.0
Solutions Enabler - addressed in versions 9.1.0.17, 9.2.2.0
Unisphere for PowerMax Virtual Appliance - addressed in versions 9.1.0.28, 9.2.2.2
Unisphere for PowerMax - addressed in versions 9.1.0.28, 9.2.2.2

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34484

• Privilege escalation in Microsoft Windows User Profile Service
• Multiple vulnerabilities in Dell EMC Unisphere for PowerMax and Dell EMC Solutions Enabler