CVE-2024-43573
Vulnerability from cvelistv5
Published
2024-10-08 17:35
Modified
2024-11-12 17:21
Severity ?
EPSS score ?
Summary
Windows MSHTML Platform Spoofing Vulnerability
References
▼ | URL | Tags | |
---|---|---|---|
secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573 | Patch, Vendor Advisory |
Impacted products
Vendor | Product | Version | |||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|---|
▼ | Microsoft | Windows 10 Version 22H2 |
Version: 10.0.0 < 10.0.19045.5011 cpe:2.3:o:microsoft:windows_10_22H2:10.0.19045.5011:*:*:*:*:*:x64:* cpe:2.3:o:microsoft:windows_10_22H2:10.0.19045.5011:*:*:*:*:*:arm64:* cpe:2.3:o:microsoft:windows_10_22H2:10.0.19045.5011:*:*:*:*:*:x86:* |
||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||||
|
CISA Known exploited vulnerability
Data from the Known Exploited Vulnerabilities Catalog
Date added: 2024-10-08
Due date: 2024-10-29
Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
Used in ransomware: Unknown
Notes: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43573
{ "containers": { "adp": [ { "metrics": [ { "other": { "content": { "id": "CVE-2024-43573", "options": [ { "Exploitation": "active" }, { "Automatable": "no" }, { "Technical Impact": "partial" } ], "role": "CISA Coordinator", "timestamp": "2024-10-09T13:06:36.400528Z", "version": "2.0.3" }, "type": "ssvc" } }, { "other": { "content": { "dateAdded": "2024-10-08", "reference": "https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json" }, "type": "kev" } } ], "providerMetadata": { "dateUpdated": "2024-10-09T13:06:57.966Z", "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP" }, "title": "CISA ADP Vulnrichment" } ], "cna": { "affected": [ { "cpes": [ "cpe:2.3:o:microsoft:windows_10_22H2:10.0.19045.5011:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10_22H2:10.0.19045.5011:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_10_22H2:10.0.19045.5011:*:*:*:*:*:x86:*" ], "platforms": [ "x64-based Systems", "ARM64-based Systems", "32-bit Systems" ], "product": "Windows 10 Version 22H2", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.19045.5011", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.3260:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_11_21H2:10.0.22000.3260:*:*:*:*:*:x64:*" ], "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "product": "Windows 11 version 21H2", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.22000.3260", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_11_22H2:10.0.22621.4317:*:*:*:*:*:arm64:*", "cpe:2.3:o:microsoft:windows_11_22H2:10.0.22621.4317:*:*:*:*:*:x64:*" ], "platforms": [ "ARM64-based Systems", "x64-based Systems" ], "product": "Windows 11 version 22H2", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.22621.4317", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_11_23H2:10.0.22631.4317:*:*:*:*:*:arm64:*" ], "platforms": [ "ARM64-based Systems" ], "product": "Windows 11 version 22H3", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.22631.4317", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_2022:10.0.20348..2762:*:*:*:*:*:*:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2022", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.20348..2762", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_23h2:10.0.25398.1189:*:*:*:*:*:*:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2022, 23H2 Edition (Server Core installation)", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.25398.1189", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.5011:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.5011:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10_21H2:10.0.19044.5011:*:*:*:*:*:arm64:*" ], "platforms": [ "32-bit Systems", "x64-based Systems", "ARM64-based Systems" ], "product": "Windows 10 Version 21H2", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.19044.5011", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_11_23H2:10.0.22631.4317:*:*:*:*:*:x64:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows 11 Version 23H2", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.22631.4317", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.6414:*:*:*:*:*:*:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2019", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.17763.6414", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.6414:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10_1809:10.0.17763.6414:*:*:*:*:*:x86:*" ], "platforms": [ "x64-based Systems", "32-bit Systems" ], "product": "Windows 10 Version 1809", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.17763.6414", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_2019:10.0.17763.6414:*:*:*:*:*:*:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2019 (Server Core installation)", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.17763.6414", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_11_24H2:10.0.26100.2033:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_11_24H2:10.0.26100.2033:*:*:*:*:*:arm64:*" ], "platforms": [ "x64-based Systems", "ARM64-based Systems" ], "product": "Windows 11 Version 24H2", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.26100.2033", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.20796:*:*:*:*:*:x86:*", "cpe:2.3:o:microsoft:windows_10_1507:10.0.10240.20796:*:*:*:*:*:x64:*" ], "platforms": [ "32-bit Systems", "x64-based Systems" ], "product": "Windows 10 Version 1507", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.10240.20796", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.7428:*:*:*:*:*:*:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2016", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.14393.7428", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.7428:*:*:*:*:*:x64:*", "cpe:2.3:o:microsoft:windows_10_1607:10.0.14393.7428:*:*:*:*:*:x86:*" ], "platforms": [ "x64-based Systems", "32-bit Systems" ], "product": "Windows 10 Version 1607", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.14393.7428", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.22221:*:*:*:*:*:x64:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2012 R2 (Server Core installation)", "vendor": "Microsoft", "versions": [ { "lessThan": "6.3.9600.22221", "status": "affected", "version": "6.3.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_2016:10.0.14393.7428:*:*:*:*:*:*:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2016 (Server Core installation)", "vendor": "Microsoft", "versions": [ { "lessThan": "10.0.14393.7428", "status": "affected", "version": "10.0.0", "versionType": "custom" } ] }, { "cpes": [ "cpe:2.3:o:microsoft:windows_server_2012_R2:6.3.9600.22221:*:*:*:*:*:x64:*" ], "platforms": [ "x64-based Systems" ], "product": "Windows Server 2012 R2", "vendor": "Microsoft", "versions": [ { "lessThan": "6.3.9600.22221", "status": "affected", "version": "6.3.0", "versionType": "custom" } ] } ], "datePublic": "2024-10-08T07:00:00+00:00", "descriptions": [ { "lang": "en-US", "value": "Windows MSHTML Platform Spoofing Vulnerability" } ], "metrics": [ { "cvssV3_1": { "baseScore": 6.5, "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C", "version": "3.1" }, "format": "CVSS", "scenarios": [ { "lang": "en-US", "value": "GENERAL" } ] } ], "problemTypes": [ { "descriptions": [ { "cweId": "CWE-79", "description": "CWE-79: Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)", "lang": "en-US", "type": "CWE" } ] } ], "providerMetadata": { "dateUpdated": "2024-11-12T17:21:49.399Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft" }, "references": [ { "name": "Windows MSHTML Platform Spoofing Vulnerability", "tags": [ "vendor-advisory" ], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573" } ], "title": "Windows MSHTML Platform Spoofing Vulnerability" } }, "cveMetadata": { "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2024-43573", "datePublished": "2024-10-08T17:35:31.236Z", "dateReserved": "2024-08-14T01:08:33.544Z", "dateUpdated": "2024-11-12T17:21:49.399Z", "state": "PUBLISHED" }, "dataType": "CVE_RECORD", "dataVersion": "5.1", "meta": { "cisa_known_exploited": { "cveID": "CVE-2024-43573", "cwes": "[\"CWE-79\"]", "dateAdded": "2024-10-08", "dueDate": "2024-10-29", "knownRansomwareCampaignUse": "Unknown", "notes": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573 ; https://nvd.nist.gov/vuln/detail/CVE-2024-43573", "product": "Windows", "requiredAction": "Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.", "shortDescription": "Microsoft Windows MSHTML Platform contains an unspecified spoofing vulnerability which can lead to a loss of confidentiality.", "vendorProject": "Microsoft", "vulnerabilityName": "Microsoft Windows MSHTML Platform Spoofing Vulnerability" }, "nvd": "{\"cve\":{\"id\":\"CVE-2024-43573\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2024-10-08T18:15:24.817\",\"lastModified\":\"2024-10-25T18:17:35.217\",\"vulnStatus\":\"Analyzed\",\"cveTags\":[],\"cisaExploitAdd\":\"2024-10-08\",\"cisaActionDue\":\"2024-10-29\",\"cisaRequiredAction\":\"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.\",\"cisaVulnerabilityName\":\"Microsoft Windows MSHTML Platform Spoofing Vulnerability\",\"descriptions\":[{\"lang\":\"en\",\"value\":\"Windows MSHTML Platform Spoofing Vulnerability\"},{\"lang\":\"es\",\"value\":\"Vulnerabilidad de suplantaci\u00f3n de la plataforma MSHTML de Windows\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"HIGH\",\"availabilityImpact\":\"NONE\",\"baseScore\":8.1,\"baseSeverity\":\"HIGH\"},\"exploitabilityScore\":2.8,\"impactScore\":5.2},{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"attackVector\":\"NETWORK\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\",\"baseScore\":6.5,\"baseSeverity\":\"MEDIUM\"},\"exploitabilityScore\":2.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"NVD-CWE-noinfo\"}]},{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-79\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*\",\"versionEndExcluding\":\"10.0.10240.20796\",\"matchCriteriaId\":\"8D5CDF9D-43B5-411C-9627-14DECDA937BF\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*\",\"versionEndExcluding\":\"10.0.10240.20796\",\"matchCriteriaId\":\"84562B34-6BC0-4DBD-B153-C8F1A065A08D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*\",\"versionEndExcluding\":\"10.0.14393.7428\",\"matchCriteriaId\":\"58DB776E-E3B6-4990-8AA2-6A63FDAA84C4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*\",\"versionEndExcluding\":\"10.0.14393.7428\",\"matchCriteriaId\":\"4AC4CAAB-C035-4D00-8DBC-9C3CE39FBBD4\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.17763.6414\",\"matchCriteriaId\":\"3E73B5EB-3264-4FFD-A467-03F716E8B410\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:arm64:*\",\"versionEndExcluding\":\"10.0.19044.5011\",\"matchCriteriaId\":\"D13B5EE1-0F5A-4DD8-9462-18FC0D2A59EE\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x64:*\",\"versionEndExcluding\":\"10.0.19044.5011\",\"matchCriteriaId\":\"857DFFF9-C926-41C5-96E6-7CD3DD86FDD8\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:x86:*\",\"versionEndExcluding\":\"10.0.19044.5011\",\"matchCriteriaId\":\"73AD21BF-973F-47E2-8831-A8B9DD066D75\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:arm64:*\",\"versionEndExcluding\":\"10.0.19045.5011\",\"matchCriteriaId\":\"6DDD519F-4617-4958-A2AA-5E5EC9D6E0E1\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x64:*\",\"versionEndExcluding\":\"10.0.19045.5011\",\"matchCriteriaId\":\"FD728A6F-4F70-4407-B19C-92DF529793EC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:x86:*\",\"versionEndExcluding\":\"10.0.19045.5011\",\"matchCriteriaId\":\"11B05B8E-F956-45E2-A735-B3169384178F\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.22000.3260\",\"matchCriteriaId\":\"68801079-35D1-4489-A0AE-DA780FF4F9BC\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.22621.4317\",\"matchCriteriaId\":\"E727AE65-9D9E-49BA-A875-9D50FAE9F7DB\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:arm64:*\",\"versionEndExcluding\":\"10.0.22631.4317\",\"matchCriteriaId\":\"FD22B308-7AB1-4820-8B4F-E79C18DB0FF0\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:x64:*\",\"versionEndExcluding\":\"10.0.22631.4317\",\"matchCriteriaId\":\"6D7CF880-E057-4694-8DD2-FF62D41A5BB7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.26100.2033\",\"matchCriteriaId\":\"E07DF8B6-0DF9-4BF1-9C9B-4A29F9611C8A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:x64:*\",\"matchCriteriaId\":\"8968BAC8-A1DB-4F88-89F8-4BE47919C247\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.14393.7428\",\"matchCriteriaId\":\"AF65E43A-AD45-43C6-A371-7C29C5CA0BA7\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.17763.6414\",\"matchCriteriaId\":\"F003109E-32C0-4044-89D6-2747366E051D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.20348..2762\",\"matchCriteriaId\":\"AC8DD27D-4538-4CB9-894A-3BF3DFF9D25A\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*\",\"versionEndExcluding\":\"10.0.25398.1189\",\"matchCriteriaId\":\"B3B68BF1-40C7-45E9-BD3C-8CEE104054E9\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}" } }
Loading…
Loading…
Sightings
Author | Source | Type | Date |
---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.