{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "\u003ca href=\"https://twitter.com/filip_dragovic\"\u003eFilip Dragovi\u0107\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-28916 Xbox Gaming Services Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28916"
      },
      {
        "category": "self",
        "summary": "CVE-2024-28916 Xbox Gaming Services Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-28916.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Xbox Gaming Services Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2024-03-22T07:00:00.000Z",
      "generator": {
        "date": "2025-05-03T00:46:37.573Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-28916",
      "initial_release_date": "2024-03-12T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-03-22T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c19.87.13001.0",
            "product": {
              "name": "Xbox Gaming Services \u003c19.87.13001.0",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "19.87.13001.0",
            "product": {
              "name": "Xbox Gaming Services 19.87.13001.0",
              "product_id": "12316"
            }
          }
        ],
        "category": "product_name",
        "name": "Xbox Gaming Services"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-28916",
      "cwe": {
        "id": "CWE-59",
        "name": "Improper Link Resolution Before File Access (\u0027Link Following\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.",
          "title": "What privileges could be gained by an attacker who successfully exploited this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An exploited vulnerability can affect resources beyond the security scope managed by the security authority of the vulnerable component. In this case, the vulnerable component and the impacted component are different and managed by different security authorities.",
          "title": "According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker must have local access to the targeted machine and must be able to create folders and performance traces on the machine, with restricted privileges that normal users have by default.",
          "title": "According to the CVSS metrics, the attack vector is local (AV:L) and privilege required is low (PR:L). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "The Microsoft Store will automatically update affected customers. Alternatively, customers can get the update immediately; see here for information about the apps installed on your device.\nIt is possible for customers to disable automatic updates for the Microsoft Store. The Microsoft Store will not automatically install this update for those customers.\nIf you want to get updates immediately, or if you don\u0027t have automatic updates enabled, select Get Updates. You can then update apps individually by selecting Update for each app, or you can select Update all to install all updates. We recommend that you select Update all as a best practice to stay protected.\nCustomers using the Microsoft Store for Business and Microsoft Store for Education can get this update through their organizations.\nApp package versions 19.87.13001.0 and later contain this update.\nYou can check the package version in PowerShell:\nget-appxpackage Microsoft.GamingServices",
          "title": "How do I get the updated app?"
        }
      ],
      "product_status": {
        "fixed": [
          "12316"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-28916 Xbox Gaming Services Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-28916"
        },
        {
          "category": "self",
          "summary": "CVE-2024-28916 Xbox Gaming Services Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/csaf/advisories/2024/msrc_cve-2024-28916.json"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-03-22T07:00:00.000Z",
          "details": "19.87.13001.0:Security Update:https://ms-windows-store://pdp?productid=9MWPM2CQNLHN",
          "product_ids": [
            "1"
          ],
          "url": "https://ms-windows-store://pdp?productid=9MWPM2CQNLHN"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 8.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "PROOF_OF_CONCEPT",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 7.9,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Publicly Disclosed:Yes;Exploited:No;Latest Software Release:Exploitation More Likely"
        }
      ],
      "title": "Xbox Gaming Services Elevation of Privilege Vulnerability"
    }
  ]
}