CVE-2007-2229
Microsoft Windows Vista uses insecure default permissions for unspecified "local user information data stores" in the registry and the file system, which allows local users to obtain sensitive information such as administrative passwords, aka…
Does this matter?
High impact if exploited, but EPSS currently rates exploitation as unlikely (1.55%). Schedule it in the normal patch cycle and watch for a rise in EPSS or a public exploit.
Description
Microsoft Windows Vista uses insecure default permissions for unspecified "local user information data stores" in the registry and the file system, which allows local users to obtain sensitive information such as administrative passwords, aka "Permissive User Information Store ACLs Information Disclosure Vulnerability."
- CVSS 2.0
- 7.2 HIGHAV:L/AC:L/Au:N/C:C/I:C/A:C
- EPSS
- 1.55% probability · 74th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-264
- Affected
- microsoft/windows vista
- Source
- secure@microsoft.com
References
- http://osvdb.org/35344
- http://secunia.com/advisories/25623Vendor Advisory
- http://www.securityfocus.com/archive/1/471947/100/0/threaded
- http://www.securityfocus.com/bid/24411
- http://www.securitytracker.com/id?1018225
- http://www.us-cert.gov/cas/techalerts/TA07-163A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2152Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-032
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1529
- http://osvdb.org/35344
- http://secunia.com/advisories/25623Vendor Advisory
- http://www.securityfocus.com/archive/1/471947/100/0/threaded
- http://www.securityfocus.com/bid/24411
- http://www.securitytracker.com/id?1018225
- http://www.us-cert.gov/cas/techalerts/TA07-163A.htmlUS Government Resource
- http://www.vupen.com/english/advisories/2007/2152Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-032
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1529
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.