CVE-2024-38200

Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)

Published: Aug 8, 2024

010
CVSS 6.5EPSS 0.32%Medium
CVE info copied to clipboard

Summary

Microsoft Office Spoofing Vulnerability. This is a high severity vulnerability with a CVSS base score of 6.5. It has a network-based attack vector, requires low attack complexity, and requires user interaction but no privileges. The vulnerability affects the confidentiality of the system, with no impact on integrity or availability.

Impact

This vulnerability could allow an attacker to gain unauthorized access to sensitive information. The attacker could execute a network-based attack to exploit this vulnerability, requiring some user interaction but no privileges. Given the high confidentiality impact, it could lead to significant data breaches or unauthorized access to sensitive documents within Microsoft Office applications. The vulnerability affects Microsoft 365 Apps, Office 2016, Office 2019, and Office Long Term Servicing Channel 2021.

Exploitation

There is no evidence that a public proof-of-concept exists. Its exploitation has been reported by various sources, including sans.edu.

Patch

A patch is available. Microsoft has released an official fix for this vulnerability on August 8, 2024. Security teams should prioritize applying this patch to all affected Microsoft Office products, including Microsoft 365 Apps, Office 2016 (x86 and x64), Office 2019 (x86 and x64), and Office Long Term Servicing Channel 2021 (x86 and x64).

Mitigation

1. Apply the official patch released by Microsoft as soon as possible to all affected Microsoft Office products. 2. Implement network segmentation to limit potential attack vectors. 3. Monitor for any suspicious network activity targeting Microsoft Office applications. 4. Ensure all Microsoft Office applications are kept up-to-date with the latest security patches. 5. Consider implementing additional access controls for sensitive data accessed through Microsoft Office applications. 6. Educate users about the risks of interacting with untrusted content or links, as user interaction is required for exploitation. 7. If immediate patching is not possible, consider temporarily restricting network access to affected Microsoft Office applications until the patch can be applied.

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C

Timeline

First Article

Feedly found the first article mentioning CVE-2024-38200. See article

Aug 8, 2024 at 8:49 PM / MSRC Security Update Guide
CVSS

A CVSS base score of 7.5 has been assigned.

Aug 8, 2024 at 8:50 PM / microsoft
CVSS Estimate

Feedly estimated the CVSS score as HIGH

Aug 8, 2024 at 8:54 PM
CVSS Estimate

Feedly estimated the CVSS score as MEDIUM

Aug 8, 2024 at 9:14 PM
Detection in Vulnerability Scanners

Detection for the vulnerability has been added to Qualys (380293)

Aug 9, 2024 at 5:15 AM
Trending

This CVE started to trend in security discussions

Aug 10, 2024 at 6:33 AM
CVE Assignment

NVD published the first details for CVE-2024-38200

Aug 12, 2024 at 1:38 PM
CVSS

A CVSS base score of 9.1 has been assigned.

Aug 13, 2024 at 1:45 PM / nvd
CVSS

A CVSS base score of 6.5 has been assigned.

Aug 13, 2024 at 6:20 PM / nvd
Static CVE Timeline Graph

Affected Systems

Microsoft/office_long_term_servicing_channel
+null more

Patches

Microsoft
+null more

Links to Mitre Att&cks

T1562.003: Impair Command History Logging
+null more

Attack Patterns

CAPEC-116: Excavation
+null more

References

Description of the security update for Office 2016: August 13, 2024 (KB5002625) - Microsoft Support
Note: To apply this security update, you must have the release version of Microsoft Office 2016 installed on the computer. Be aware that the update in the Microsoft Download Center applies to the Microsoft Installer (.msi)-based edition of Office 2016.
Microsoft August 2024 Security Updates
Classification: Critical, Solution: Official Fix, Exploit Maturity: High, CVSSv3.1: 9.8, CVEs: CVE-2024-21302, CVE-2024-29995, CVE-2024-37968, CVE-2024-38063, CVE-2024-38084, CVE-2024-38098, CVE-2024-38106, CVE-2024-38107, CVE-2024-38108, CVE-2024-38109, CVE-2024-38114, CVE-2024-38115, CVE-2024-38116, CVE-2024-38117, CVE-2024-38118, CVE-2024-38120, CVE-2024-38121, CVE-2024-38122, CVE-2024-38123, CVE-2024-38125 (+82 other associated CVEs), Summary: https://www.bleepingcomputer.com/news/microsoft/microsoft-august-2024-patch-tuesday-fixes-9-zero-days-6-exploited/ Today is Microsoft's August 2024 Patch Tuesday, which includes security updates for 89 flaws, including six actively exploited and three publicly disclosed zero-days. Microsoft is still working on an update for a tenth publicly disclosed zero-day. This Patch Tuesday fixed eight critical vulnerabilities, which were a mixture of elevation of privileges, remote code execution, and information disclosure. The number of bugs in each vulnerability category is listed below:
CVE-2024-38200 - Security Update Guide - Microsoft - Microsoft Office Spoofing Vulnerability
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted file that is designed to exploit the vulnerability. However, an attacker would have no way to force the user to visit the website. Instead, an attacker would have to convince the user to click a link, typically by way of an enticement in an email or Instant Messenger message, and then convince the user to open the specially crafted file.
See 15 more references

News

Microsoft Office Alert: Unfixed Word Issue Risks Data Leak - Hoplon InfoSec
Microsoft has warned that attackers could exploit the vulnerability to deceive them into sharing sensitive data once a user opens the malicious document. Cybercriminals could exploit this flaw by creating seemingly legitimate documents that trick users into disclosing critical data, compromising personal, financial, or corporate security.
Urgent security fixes are needed for these IT products - TechGig
A well-known and AI-driven cybersecurity platform, Cyble, has identified several high-priority vulnerabilities across products from Microsoft, Qualcomm, and the Common Unix Printing System (CUPS). CVE-2024-47176: Vulnerabilities in CUPS could enable attackers to execute remote code via distributed denial-of-service (DDoS) attacks.
Weekly IT Vulnerability Report: Cyble Urges Fixes for Ivanti, Microsoft Dark Web Exploits
Microsoft’s Patch Tuesday included five new zero-day vulnerabilities, two of which are being actively exploited – and Cyble researchers have observed threat actors discussing the other three zero-days on cybercrime forums. Additionally, Cyble researchers detected 14 vulnerabilities and exploits shared on cybercrime forums that security analysts should also prioritize – including the three Microsoft zero-days not yet under active exploitation.
Weekly IT Vulnerability Report: Cyble Urges Fixes for Ivanti, Microsoft Dark Web Exploits
Microsoft’s Patch Tuesday included five new zero-day vulnerabilities, two of which are being actively exploited – and Cyble researchers have observed threat actors discussing the other three zero-days on cybercrime forums. Additionally, Cyble researchers detected 14 vulnerabilities and exploits shared on cybercrime forums that security analysts should also prioritize – including the three Microsoft zero-days not yet under active exploitation.
TheCyberThrone Security BiWeekly Review – October 12, 2024
The vulnerability tracked as CVE-2024-38200 is an information disclosure in Microsoft Office (multiple versions) that allows attackers to capture sensitive authentication data, such as NTLMv2 hashes, over HTTP and SMB protocols. Welcome to TheCyberThrone cybersecurity week in review will be posted covering the important security happenings.
See 239 more articles and social media posts

CVSS V3.1

Attack Vector:Network
Attack Complexity:Low
Privileges Required:None
User Interaction:Required
Scope:Unchanged
Confidentiality:High
Integrity:None
Availability Impact:None

Categories

Be the first to know about critical vulnerabilities

Collect, analyze, and share vulnerability reports faster using AI