FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial
FeedlyFeedly
CVEsCVEs
Threat IntelligenceThreat Intelligence
Threat IntelligenceThreat Intelligence
Log in
ChangelogChangelog
ChangelogChangelog
Log in
Log in
Start Free Trial
Start Free Trial

CVE-2024-28916

Improper Link Resolution Before File Access ('Link Following') (CWE-59)

Published: Mar 20, 2024

010
CVSS 8.8EPSS 0.04%High
CVE info copied to clipboard

Xbox Gaming Services Elevation of Privilege Vulnerability

CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Timeline

CVE Assignment

NVD published the first details for CVE-2024-28916

Mar 20, 2024 at 5:15 PM
CVSS

A CVSS base score of 8.8 has been assigned.

Mar 20, 2024 at 11:00 PM / microsoft
First Article

Feedly found the first article mentioning CVE-2024-28916. See article

Mar 20, 2024 at 11:00 PM / Microsoft Security Advisories - MSRC
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Mar 20, 2024 at 11:00 PM
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Mar 20, 2024 at 11:00 PM
Exploitation in the Wild

Attacks in the wild have been reported by Not Simon. See article

Mar 21, 2024 at 3:56 AM / Not Simon
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Mar 21, 2024 at 5:58 AM
Threat Intelligence Report

The vulnerability CVE-2024-28916 is a critical security flaw reported by Microsoft, with a CVSS score pending. It is currently being exploited in the wild by threat actors, and there are proof-of-concept exploits available. Microsoft has provided mitigations and patches to address the vulnerability, but downstream impacts to third party vendors or technology may still be a concern. See article

Mar 21, 2024 at 6:03 AM
EPSS

EPSS Score was set to: 0.04% (Percentile: 7.3%)

Mar 21, 2024 at 3:12 PM
Static CVE Timeline Graph

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1547.009: Shortcut Modification
+null more

Attack Patterns

CAPEC-132: Symlink Attack
+null more

References

Latest vulnerabilities [Thursday, March 21, 2024]
Securitricks / 8mo
In version 1.39.0, use of raw file descriptors in `op_node_ipc_pipe()` leads to premature close of arbitrary file descriptors, allowing standard input to be re-opened as a different resource resulting in permission prompt bypass. Prior to version 1.0.0-master.a429472, RSSHub allows remote attackers to use the server as a proxy to send HTTP GET requests to arbitrary targets and retrieve information in the internal network or conduct Denial-of-Service (DoS) attacks.

News

Patch Tuesday April 2024 - One Zero Day and Record Number of Patches!
Ultimate Windows Security Newsletter / 7mo
Microsoft reports that this spoofing vulnerability is both publicly disclosed and also exploited in the wild. Microsoft reports that this elevation of privilege vulnerability is publicly disclosed and that exploitation is more likely.
Monthly news - April 2024
Microsoft Tech Community - Latest Blogs - / 7mo
Copilot can generate a summary that contains the status of Defender XDR protection features like attack surface reduction, any significant user activity observed in the device, and insights from Microsoft Intune. Read this blog post "How Copilot for Security can transform your SOC" to learn about the new capabilities embedded in the Defender portal for Defender XDR and Microsoft Sentinel data .
@RISK: The Consensus Security Vulnerability Alert: Vol. 24, Num. 13 - SANS Institute
Google Alert - security-vulnerability OR cyber-vulnerability OR software-vulnerability OR hardware-vulnerability OR systems-vulnerability / 7mo
Product: OpenText ArcSight Platform CVSS Score: 9.8 NVD: NVD References: CVE-2024-28179 - Jupyter Server Proxy prior to versions 3.2.3 and 4.1.1 allows unauthenticated remote access to websocket endpoints, potentially leading to remote unauthenticated arbitrary code execution. Product: Chirp Access CVSS Score: 9.1 NVD: NVD References: CVE-2024-1711 - The Create by Mediavine plugin for WordPress is vulnerable to SQL Injection through the 'id' parameter, allowing unauthenticated attackers to extract sensitive data in versions up to 1.9.4.
Security Bulletin 27 Mar 2024 - Cyber Security Agency of Singapore
"vulnerability exploit" - Google News / 7mo
Security Bulletin 27 Mar 2024 Cyber Security Agency of Singapore
Microsoft Xbox Gaming Services Flaw Let Attackers Gain SYSTEM Privileges
all InfoSec news / 8mo
A new elevation of privilege vulnerability has been discovered in the Xbox Gaming services that allow a threat actor to elevate their privileges to that of a SYSTEM. This particular vulnerability has been assigned CVE-2024-28916, and its severity has …
See 28 more articles and social media posts

CVSS V3.1

Attack Vector:Local
Attack Complexity:Low
Privileges Required:Low
User Interaction:None
Scope:Changed
Confidentiality:High
Integrity:High
Availability Impact:High

Categories

CVSS 8.8(18246)CWE-59(1181)

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI

Feedly Threat Intelligence30-day free trial