CVE-2023-36707: 
vulnerability analysis and mitigation

Windows Deployment Services Denial of Service Vulnerability (CVE-2023-36707) affects multiple versions of Microsoft Windows Server. The vulnerability was discovered and disclosed to Microsoft, with the initial public disclosure occurring on October 10, 2023. The affected systems include Windows Server 2012, Windows Server 2012 R2, Windows Server 2016, Windows Server 2019, and Windows Server 2022 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.5 (HIGH) by NIST with a vector string of CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H, while Microsoft assessed it with a score of 6.5 (MEDIUM) and vector string CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H. The vulnerability is classified under CWE-20 (Improper Input Validation) (NVD).

The vulnerability primarily affects the availability of Windows Deployment Services, potentially leading to denial of service conditions. The impact is focused on system availability, with no direct effect on confidentiality or integrity (NVD).

Microsoft has released security updates to address this vulnerability. The fixes are available through various KB updates including KB5031427 for Windows Server 2012, KB5031407 for Windows Server 2012 R2, KB5031362 for Windows Server 2016, KB5031361 for Windows Server 2019, and KB5031364 for Windows Server 2022 (Rapid7).