Skip to content
VulniPulse
Sign in
Highest advisory severityMedium Exploited CISA KEV 1 vendor · 1 advisory

CVE-2013-3900

CVE-2013-3900: 1 tracked advisory record across MS Server. CISA KEV listed; exploitation observed. Compare vendor sources and published fix guidance.

Compare the source-linked records below. Ratings and product/version details belong to each advisory; they are not a single CVE-wide score or proof that every listed product is affected. How VulniPulse collects and checks evidence.

NVD detail CVE.org

Vendor advisory comparison

MS Server

1 advisory
  • Advisory severityMedium5.5

    Medium [CVE-2013-3900] WinVerifyTrust Signature Validation Vulnerability

    CVE-2013-3900Source published Source updated

    Why is Microsoft republishing a CVE from 2013? We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11. While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows. This behavior remains available as an opt-in feature via reg key setting, and is available on supported editions of…

    Affected products in this advisory
    • Windows Server 2019 (Server Core installation)
    • Windows Server 2025 (Server Core installation)
    • Windows Server 2022, 23H2 Edition (Server Core installation)
    • Windows Server 2016 (Server Core installation)

    5 more entries in the full advisory.

    Source-reported affected versions
    Affected-version details not available in this record.
    Source-reported fixed versions
    No fixed-version detail extracted. This does not mean no fix exists.
    Mitigation guidance
    • We are republishing CVE-2013-3900 in the Security Update Guide to update the Security Updates table and to inform customers that the EnableCertPaddingCheck is available in all currently supported versions of Windows 10 and Windows 11.
    • While the format is different from the original CVE published in 2013, except for clarifications about how to configure the EnableCertPaddingCheck registry value, the information herein remains unchanged from the original text published on December 10, 2013, Microsoft does not plan to enforce the stricter verification behavior as a default functionality on supported releases of Microsoft Windows.
    • The supporting code for this reg key was incorporated at the time of release for Windows 10 and Windows 11, so no security update is required; however, the reg key must be set.
    • An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.

    2 more entries in the full advisory.

    Full advisory and evidenceOpen source bulletin

Android app · Google Play

Monitor future MS Server CVEs from your phone.

Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.

Matching phone alertsOptional email delivery
Get CVE alertsSee app features