Exposure of Sensitive Information to an Unauthorized Actor (CWE-200)
Microsoft Office Spoofing Vulnerability. This is a high severity vulnerability with a CVSS base score of 6.5. It has a network-based attack vector, requires low attack complexity, and requires user interaction but no privileges. The vulnerability affects the confidentiality of the system, with no impact on integrity or availability.
This vulnerability could allow an attacker to gain unauthorized access to sensitive information. The attacker could execute a network-based attack to exploit this vulnerability, requiring some user interaction but no privileges. Given the high confidentiality impact, it could lead to significant data breaches or unauthorized access to sensitive documents within Microsoft Office applications. The vulnerability affects Microsoft 365 Apps, Office 2016, Office 2019, and Office Long Term Servicing Channel 2021.
There is no evidence that a public proof-of-concept exists. Its exploitation has been reported by various sources, including sans.edu.
A patch is available. Microsoft has released an official fix for this vulnerability on August 8, 2024. Security teams should prioritize applying this patch to all affected Microsoft Office products, including Microsoft 365 Apps, Office 2016 (x86 and x64), Office 2019 (x86 and x64), and Office Long Term Servicing Channel 2021 (x86 and x64).
1. Apply the official patch released by Microsoft as soon as possible to all affected Microsoft Office products. 2. Implement network segmentation to limit potential attack vectors. 3. Monitor for any suspicious network activity targeting Microsoft Office applications. 4. Ensure all Microsoft Office applications are kept up-to-date with the latest security patches. 5. Consider implementing additional access controls for sensitive data accessed through Microsoft Office applications. 6. Educate users about the risks of interacting with untrusted content or links, as user interaction is required for exploitation. 7. If immediate patching is not possible, consider temporarily restricting network access to affected Microsoft Office applications until the patch can be applied.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Feedly found the first article mentioning CVE-2024-38200. See article
A CVSS base score of 7.5 has been assigned.
Feedly estimated the CVSS score as HIGH
Feedly estimated the CVSS score as MEDIUM
Detection for the vulnerability has been added to Qualys (380293)
This CVE started to trend in security discussions
NVD published the first details for CVE-2024-38200
A CVSS base score of 9.1 has been assigned.
A CVSS base score of 6.5 has been assigned.