CVE-2024-38221
Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') (CWE-79)
Summary
A spoofing vulnerability has been identified in Microsoft Edge (Chromium-based). This vulnerability is related to improper neutralization of input during web page generation, commonly known as Cross-site Scripting (XSS). The vulnerability affects versions of Microsoft Edge (Chromium-based) prior to 129.0.2792.52.
Impact
If exploited, this vulnerability could allow an attacker to perform cross-site scripting attacks. The potential impacts include: 1. Spoofing: An attacker could trick users into believing they are interacting with a legitimate website when they are not. 2. Information disclosure: Sensitive user data could be stolen if the attacker manages to execute malicious scripts in the context of the user's browser. 3. Session hijacking: The attacker might be able to steal session tokens and impersonate the user on the affected website. 4. Phishing: Users could be redirected to malicious websites or presented with fake forms to steal credentials. The severity of this vulnerability is considered moderate, with a CVSS v3.1 base score of 4.3. The impact on integrity is low, while there is no direct impact on confidentiality or availability. User interaction is required for successful exploitation, which somewhat mitigates the risk.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available for this vulnerability. Microsoft has released an update to address the issue in Edge (Chromium-based) version 129.0.2792.52 and later. The security team should prioritize updating Microsoft Edge to this version or newer to mitigate the risk.
Mitigation
To mitigate this vulnerability, the following steps are recommended: 1. Update Microsoft Edge: Apply the latest security update to bring Edge to version 129.0.2792.52 or later. 2. Enable automatic updates: Configure Microsoft Edge to automatically install updates to ensure timely protection against future vulnerabilities. 3. User education: Inform users about the risks of clicking on suspicious links or interacting with untrusted websites. 4. Implement content security policies: Use CSP headers to restrict the sources of content that can be loaded by the browser, reducing the risk of XSS attacks. 5. Input validation and output encoding: Encourage development teams to implement proper input validation and output encoding practices in web applications to prevent XSS vulnerabilities. 6. Consider using browser extensions: Recommend security extensions that can help detect and prevent XSS attacks for an added layer of protection. 7. Monitor for exploitation: Use intrusion detection systems and web application firewalls to detect and block potential XSS attacks targeting this vulnerability.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:U/RL:O/RC:C
Timeline
A CVSS base score of 4.3 has been assigned.
Feedly found the first article mentioning CVE-2024-38221. See article
NVD published the first details for CVE-2024-38221
Feedly estimated the CVSS score as LOW
Feedly estimated the CVSS score as MEDIUM
Detection for the vulnerability has been added to Qualys (380529)
EPSS Score was set to: 0.05% (Percentile: 17.7%)
Detection for the vulnerability has been added to Nessus (207516)
EPSS Score was set to: 0.06% (Percentile: 28.5%)