Man-in-the-Middle (MitM) attack in Microsoft Endpoint Configuration Manager - CVE-2022-37972

Vulnerability details

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Microsoft Endpoint Configuration Manager handles Kerberos authentication failures. The application attempts to use NTLM to authenticate even if disabled by the "Allow connection fallback to NTLM" option. A remote attacker can perform spoofing attack and extract victims credentials via NTLM connection.

Affected software

How to mitigate CVE-2022-37972

External References

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37972
• https://learn.microsoft.com/en-us/mem/configmgr/hotfix/2207/15498768

Related Security Bulletins

• Spoofing attack in Microsoft Endpoint Configuration Manager