#VU67518 Man-in-the-Middle (MitM) attack in Microsoft Endpoint Configuration Manager - CVE-2022-37972

Description

The vulnerability allows a remote attacker to gain access to sensitive information.

The vulnerability exists due to the way Microsoft Endpoint Configuration Manager handles Kerberos authentication failures. The application attempts to use NTLM to authenticate even if disabled by the "Allow connection fallback to NTLM" option. A remote attacker can perform spoofing attack and extract victims credentials via NTLM connection.

Remediation

External links

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2022-37972
• https://learn.microsoft.com/en-us/mem/configmgr/hotfix/2207/15498768