{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "\u003ca href=\"https://www.linkedin.com/in/charikovandrey/\"\u003eAndrey Charikov\u003c/a\u003e with \u003ca href=\"https://www.checkpoint.com/\"\u003eCheck Point Software Technologies\u003c/a\u003e"
        ]
      },
      {
        "names": [
          "\u003ca href=\"https://www.linkedin.com/in/oded-vanunu-a131283/\"\u003eOded Vanunu\u003c/a\u003e with \u003ca href=\"https://www.checkpoint.com/\"\u003eCheck Point Software Technologies\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2024-38197 Microsoft Teams for iOS Spoofing Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38197"
      },
      {
        "category": "self",
        "summary": "CVE-2024-38197 Microsoft Teams for iOS Spoofing Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2024/msrc_cve-2024-38197.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Teams for iOS Spoofing Vulnerability",
    "tracking": {
      "current_release_date": "2024-08-13T07:00:00.000Z",
      "generator": {
        "date": "2024-12-31T22:30:41.206Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2024-38197",
      "initial_release_date": "2024-08-13T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2024-08-13T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c7.13.0",
            "product": {
              "name": "Microsoft Teams for iOS \u003c7.13.0",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "7.13.0",
            "product": {
              "name": "Microsoft Teams for iOS 7.13.0",
              "product_id": "11858"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Teams for iOS"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2024-38197",
      "cwe": {
        "id": "CWE-451",
        "name": "User Interface (UI) Misrepresentation of Critical Information"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "The attacker is only able to modify the sender\u0027s name of Teams message (I:L) and through social engineering, attempt to trick the recipient into disclosing information (C:L). The availability of the product cannot be affected (A:N).",
          "title": "According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of confidentiality (C:L) and integrity (I:L) but does not impact availability (A:N)? What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "Tap the Settings icon\nTap the** iTunes \u0026amp; App Store**\nTurn on AUTOMATIC DOWNLOADS for Apps\nTap the** App Store** icon\nScroll down to find Microsoft Teams\nTap the Update button",
          "title": "How do I get the update for Microsoft Teams for iOS?"
        },
        {
          "category": "faq",
          "text": "Tap the Play Store icon on your home screen.\nTap the circular account icon at the top right of the screen.\nTap Manage apps \u0026amp; devices.\nTap Updates available.\nTap the Update button next to the Microsoft Teams app.\nYes: https://play.google.com/store/apps/details?id=com.microsoft.teams",
          "title": "How do I get the update for Teams for Android?"
        }
      ],
      "product_status": {
        "fixed": [
          "11858"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2024-38197 Microsoft Teams for iOS Spoofing Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38197"
        },
        {
          "category": "self",
          "summary": "CVE-2024-38197 Microsoft Teams for iOS Spoofing Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38197"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2024-08-13T07:00:00.000Z",
          "details": "7.13.0:Security Update:https://apps.apple.com/us/app/microsoft-teams/id1113153706",
          "product_ids": [
            "1"
          ],
          "url": "https://apps.apple.com/us/app/microsoft-teams/id1113153706"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "NETWORK",
            "availabilityImpact": "NONE",
            "baseScore": 6.5,
            "baseSeverity": "MEDIUM",
            "confidentialityImpact": "LOW",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "LOW",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 5.7,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:N/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Spoofing"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Microsoft Teams for iOS Spoofing Vulnerability"
    }
  ]
}