IP-DB.com
Türkçe English Deutsch Español
Entrar Obtener clave API
5.4Media KEV

CVE-2024-38217Windows Mark of the Web Security Feature Bypass Vulnerability

Microsoft Windows 10 Version 1507; Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2 Publicada: (hace 2 años)

Explotación conocida — Microsoft Windows Mark of the Web (MOTW) Protection Mechanism Failure Vulnerability

CISA confirmó el 10.09.2024 que esta vulnerabilidad se usa en ataques reales. Plazo para las agencias federales de EE. UU.: 01.10.2024.

Acción requerida: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38217; https://nvd.nist.gov/vuln/detail/CVE-2024-38217

Descripción

Windows Mark of the Web Security Feature Bypass Vulnerability

Debilidad (CWE): CWE-693

Datos: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Se publican tal como los indican las fuentes, en inglés.

Productos y versiones afectados

FabricanteProductoVersiones
microsoft windows 10 1507 10.0.10240.0 – < 10.0.10240.20766
microsoft windows 10 1607 10.0.14393.0 – < 10.0.14393.7336
microsoft windows 10 1809 10.0.17763.0 – < 10.0.17763.6293
microsoft windows 10 21H2 10.0.19043.0 – < 10.0.19044.4894
microsoft windows 10 22H2 10.0.19045.0 – < 10.0.19045.4894
Microsoft Windows 10 Version 1507 10.0.10240.0 – < 10.0.10240.20766
Microsoft Windows 10 Version 1607 10.0.14393.0 – < 10.0.14393.7336
Microsoft Windows 10 Version 1809 10.0.17763.0 – < 10.0.17763.6293
Microsoft Windows 10 Version 21H2 10.0.19043.0 – < 10.0.19044.4894
Microsoft Windows 10 Version 22H2 10.0.19045.0 – < 10.0.19045.4894
microsoft windows 11 21H2 10.0.0 – < 10.0.22000.3197
microsoft windows 11 22H2 10.0.22621.0 – < 10.0.22621.4169
microsoft windows 11 23H2 10.0.22631.0 – < 10.0.22631.4169
microsoft windows 11 24H2 10.0.26100.0 – < 10.0.26100.1742
Microsoft Windows 11 version 21H2 10.0.0 – < 10.0.22000.3197
Microsoft Windows 11 version 22H2 10.0.22621.0 – < 10.0.22621.4169
Microsoft Windows 11 version 22H3 10.0.22631.0 – < 10.0.22631.4169
Microsoft Windows 11 Version 23H2 10.0.22631.0 – < 10.0.22631.4169
Microsoft Windows 11 Version 24H2 10.0.26100.0 – < 10.0.26100.1742
microsoft windows server 2008 r2
microsoft windows server 2008 R2 6.1.7601.0 – < 6.1.7601.27320
Microsoft Windows Server 2008 R2 Service Pack 1 6.1.7601.0 – < 6.1.7601.27320
Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation) 6.1.7601.0 – < 6.1.7601.27320
Microsoft Windows Server 2008 Service Pack 2 6.0.6003.0 – < 6.0.6003.22870
Microsoft Windows Server 2008 Service Pack 2 (Server Core installation) 6.0.6003.0 – < 6.0.6003.22870
microsoft windows server 2008 sp2 6.0.6003.0 – < 6.0.6003.22870
Microsoft Windows Server 2012 6.2.9200.0 – < 6.2.9200.25073
Microsoft Windows Server 2012 R2 6.3.9600.0 – < 6.3.9600.22175
Microsoft Windows Server 2012 R2 (Server Core installation) 6.3.9600.0 – < 6.3.9600.22175
Microsoft Windows Server 2012 (Server Core installation) 6.2.9200.0 – < 6.2.9200.25073
Microsoft Windows Server 2016 10.0.14393.0 – < 10.0.14393.7336
Microsoft Windows Server 2016 (Server Core installation) 10.0.14393.0 – < 10.0.14393.7336
Microsoft Windows Server 2019 10.0.17763.0 – < 10.0.17763.6293
Microsoft Windows Server 2019 (Server Core installation) 10.0.17763.0 – < 10.0.17763.6293
Microsoft Windows Server 2022 10.0.20348.0 – < 10.0.20348.2700
microsoft windows server 2022 23h2 < 10.0.25398.1128
Microsoft Windows Server 2022, 23H2 Edition (Server Core installation) 10.0.25398.0 – < 10.0.25398.1128
microsoft windows server 23h2 10.0.25398.0 – < 10.0.25398.1128

Referencias y parches

Coincidencias CPE (NVD) (21)
  • cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:* < 10.0.10240.20766
  • cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:* < 10.0.10240.20766
  • cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:* < 10.0.14393.7336
  • cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:* < 10.0.14393.7336
  • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:* < 10.0.17763.6293
  • cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:* < 10.0.17763.6293
  • cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:* < 10.0.19044.4894
  • cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:* < 10.0.19045.4894
  • cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:* < 10.0.22000.3197
  • cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:* < 10.0.22621.4169
  • cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:* < 10.0.22631.4169
  • cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:* < 10.0.26100.1742
  • cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:* < 10.0.26100.1742
  • cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
  • cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
  • cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* < 10.0.14393.7336
  • cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:* < 10.0.17763.6293
  • cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:* < 10.0.20348.2700
  • cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:* < 10.0.25398.1128

CVE recientes del mismo producto — Windows 10

7.8Alta
CVE-2026-119382

Windows TPM Elevation of Privilege Vulnerability

Microsoft Windows 10 Version 1607; Microsoft Windows 10 Version 1809; Microsoft Windows 10 Version 21H2; Microsoft Windows 10 Version 22H2

Heap-based buffer overflow in Windows TPM allows an authorized attacker to elevate privileges locally.