CVE-2024-38213

MEDIUM CISA KEV EPSS 95.9%
Published Aug 13, 20241y ago · Modified Jun 17, 20261w ago
6.5 CVSS 3.1
Medium
Find Similar
Published Aug 13, 2024 1y ago
Last Modified Jun 17, 2026 1w ago
KEV Listed Aug 13, 2024 1y ago
KEV Due Sep 3, 2024 665d overdue

Description

Windows Mark of the Web Security Feature Bypass Vulnerability

CVSS Details

Base Score
6.5
Exploitability
2.8
Impact
3.6
Vector string
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
Attack Vector Network
Attack Complexity Low
Privileges Required None
User Interaction Required
Scope Unchanged
Confidentiality None
Integrity High
Availability None

Threat Intelligence

CISA Known Exploited Overdue 665d
Added
Aug 13, 2024
Due
Sep 3, 2024

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

EPSS Exploit Probability
95.9% percentile
Exploit & Patch Status
Actively Exploited (KEV)
Patch Available

Weaknesses 1

CWE-693

Affected Products 14

VendorProductVersionRange
microsoftwindows_10_1507* <10.0.10240.20680
microsoftwindows_10_1607* <10.0.14393.7070
microsoftwindows_10_1809* <10.0.17763.5936
microsoftwindows_10_21h2* <10.0.19044.4529
microsoftwindows_10_22h2* <10.0.19045.4529
microsoftwindows_11_21h2* <10.0.22000.3019
microsoftwindows_11_22h2* <10.0.22621.3737
microsoftwindows_11_23h2* <10.0.22631.3737
microsoftwindows_server_2012* <6.2.9200.24919
microsoftwindows_server_2012r2any
microsoftwindows_server_2016* <10.0.14393.7070
microsoftwindows_server_2019* <10.0.17763.5936
microsoftwindows_server_2022* <10.0.20348.2522
microsoftwindows_server_2022_23h2* <10.0.25398.950

References 2

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38213
    PatchVendor Advisory
  • cisa.gov https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2024-38213
    US Government Resource

Remediation

  • msrc.microsoft.com https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38213
    PatchVendor Advisory