Windows Remote Desktop Gateway (RD Gateway) Information Disclosure Vulnerability

Affected versions

NVD version ranges (for catalog products). Add the product to your stack with a version and matching uses these.

• microsoft windows server 2008r2
• microsoft windows server 2012all versions
• microsoft windows server 2012r2
• microsoft windows server 2016all versions
• microsoft windows server 2019all versions
• microsoft windows server 2022all versions

Versions reported by the vendor

Affected version ranges reported by the assigning authority (microsoft). Independent of NVD's CPE analysis and usually ahead of it.

• Microsoft Windows Server 2008 R2 Service Pack 1

  • 6.1.7601.0 and later · before 6.1.7601.26769affected

• Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)

  • 6.1.7601.0 and later · before 6.1.7601.26769affected

• Microsoft Windows Server 2012

  • 6.2.9200.0 and later · before 6.2.9200.24523affected

• Microsoft Windows Server 2012 (Server Core installation)

  • 6.2.9200.0 and later · before 6.2.9200.24523affected

• Microsoft Windows Server 2012 R2

  • 6.3.9600.0 and later · before 6.3.9600.21620affected

• Microsoft Windows Server 2012 R2 (Server Core installation)

  • 6.3.9600.0 and later · before 6.3.9600.21620affected

• Microsoft Windows Server 2016

  • 10.0.14393.0 and later · before 10.0.14393.6351affected

• Microsoft Windows Server 2016 (Server Core installation)

  • 10.0.14393.0 and later · before 10.0.14393.6351affected

• Microsoft Windows Server 2019

  • 10.0.17763.0 and later · before 10.0.17763.4974affected

• Microsoft Windows Server 2019 (Server Core installation)

  • 10.0.17763.0 and later · before 10.0.17763.4974affected

• Microsoft Windows Server 2022

  • 10.0.20348.0 and later · before 10.0.20348.2031affected

Other highest-scoring records for the same primary product.

• CVE-2020-1350A remote code execution vulnerability exists in Windows Domain Name System servers when they fail to properly handle requests, aka 'Windows KEV
  99Now
• CVE-2020-1040A remote code execution vulnerability exists when Hyper-V RemoteFX vGPU on a host server fails to properly validate input from an authenticaKEV
  68This week
• CVE-2009-3103Array index error in the SMBv2 protocol implementation in srv2.sys in Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold a
  68This week
• CVE-2024-38077Windows Remote Desktop Licensing Service Remote Code Execution Vulnerability
  64This week
• CVE-2009-2532Microsoft Windows Vista Gold, SP1, and SP2, Windows Server 2008 Gold and SP2, and Windows 7 RC do not properly process the command value in
  59Plan
• CVE-2018-8476A remote code execution vulnerability exists in the way that Windows Deployment Services TFTP Server handles objects in memory, aka "Windows
  58Plan

FIRST EPSS daily score; only changes of 0.01 or more are recorded (step chart).

Root cause

The extension requests broader permissions than its function needs and sends the data it collects out for purposes beyond its stated function.

A representative example of this vulnerability class. Not the vendor's source code; it shows the faulty pattern and its fix.

1{2  "permissions": ["tabs", "<all_urls>"],3  "background": { "service_worker": "analytics.js" }4}

1{2  "permissions": ["activeTab"],3  "host_permissions": ["https://yildiz.example/*"]4}

Attack context

MITRE CAPEC attack patterns and ATT&CK techniques for this weakness class (CWE). A starting point for detection rules and threat hunting.