Main Vulnerability Database Vulnerabilities #VU71071

Security features bypass in Microsoft Windows and Windows Server - CVE-2023-21560

Published: January 11, 2023

Vulnerability identifier: #VU71071

CSH Severity: Low

CVSS v4: 7 [CVSS:4.0/AV:P/AC:L/AT:N/PR:L/UI:N/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-21560

CWE-ID: CWE-254

Exploitation vector: Local access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a local user to compromise the target system.

The vulnerability exists due to security features bypass in Windows Boot Manager. An authenticated attacker with physical access can bypass the BitLocker Device Encryption feature and gain access to encrypted data.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2023-21560

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-21560

Related Security Bulletins