Improper Access Control in Windows NTFS by Microsoft
CVE-2025-21197
6.5MEDIUM
Key Information:
- Vendor
- Microsoft
- Status
- Vendor
- CVE Published:
- 8 April 2025
Summary
A vulnerability exists in Windows NTFS where improper access control mechanisms could allow an authorized attacker to disclose sensitive file path information within a folder. This disclosure occurs even if the attacker does not have permission to list the contents of that folder, potentially leading to further exploitation and unauthorized access to secured files.
Affected Version(s)
Windows 10 Version 1507 32-bit Systems 10.0.10240.0 < 10.0.10240.20978
Windows 10 Version 1607 32-bit Systems 10.0.14393.0 < 10.0.14393.7969
Windows 10 Version 1809 32-bit Systems 10.0.17763.0 < 10.0.17763.7136
References
CVSS V3.1
Score:
6.5
Severity:
MEDIUM
Confidentiality:
High
Integrity:
None
Availability:
High
Attack Vector:
Network
Attack Complexity:
Low
Privileges Required:
Low
User Interaction:
None
Scope:
Unchanged
Timeline
Vulnerability published
Vulnerability Reserved