Why defender for endpoints say that does't exist the CVE-2013-3900 and when I see the REG entry, they really exist ?

Question

Why defender for endpoints say that does't exist the CVE-2013-3900 and when I see the REG entry, they really exist ?

Andrew Matheus da Silva Lobo 5

In the Microsoft Defender for Endpoint (MDE) console, when I search for CVE-2013-3900 (WinVerifyTrust), the results show zero vulnerable endpoints. However, mitigating this CVE primarily involves creating a registry entry, and in all the endpoints I’ve analyzed, none have this registry entry in place. Other vulnerability assessment tools detect this vulnerability, but MDE does not.

My question is: Why does MDE fail to recognize the vulnerability while other tools do ?

Prathista Ilango 265 Reputation points Microsoft Employee

2024-11-18T07:28:09.6333333+00:00

Hello @Andrew Matheus da Silva Lobo
I am not sure why MDE is not flagging this. It's recommended to reach out to Microsoft support for a definite answer, as they will be able to confirm or help troubleshoot and identify the underlying issue, if any.
You can contact support from here: Contact Microsoft Defender for Endpoint support - Microsoft Defender for Endpoint | Microsoft Learn