CVE-2024-43596
Access of Resource Using Incompatible Type ('Type Confusion') (CWE-843)
Summary
A Remote Code Execution Vulnerability has been identified in Microsoft Edge (Chromium-based). This vulnerability is classified as a Type Confusion issue, which falls under the Common Weakness Enumeration (CWE) category CWE-843: Access of Resource Using Incompatible Type. The vulnerability affects Microsoft Edge (Chromium-based) versions prior to 130.0.2849.46.
Impact
This vulnerability has a high severity with a CVSS v3.1 base score of 8.8 out of 10. The impact is significant, with high potential for compromising confidentiality, integrity, and availability of the affected systems. The attack vector is network-based, requiring user interaction but no privileges, and has low attack complexity. If exploited, an attacker could potentially execute arbitrary code on the target system, leading to full system compromise. This could result in unauthorized access to sensitive data, modification of system files, or disruption of services.
Exploitation
There is no evidence that a public proof-of-concept exists. There is no evidence of proof of exploitation at the moment.
Patch
A patch is available for this vulnerability. Microsoft has released an update to address the issue in Microsoft Edge (Chromium-based). The patch was made available on October 17, 2024, and can be obtained through the Microsoft Update Guide.
Mitigation
To mitigate this vulnerability, it is strongly recommended to update Microsoft Edge (Chromium-based) to version 130.0.2849.46 or later as soon as possible. Given the high severity score and the potential for remote code execution, this update should be prioritized in patching efforts. Additionally, as user interaction is required for exploitation, educating users about the risks of interacting with untrusted content or visiting suspicious websites can serve as an additional layer of protection. It's also advisable to monitor for any unusual activities or unauthorized access attempts on systems running vulnerable versions of Microsoft Edge.
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C
Timeline
Feedly found the first article mentioning CVE-2024-43596. See article
Feedly estimated the CVSS score as HIGH
NVD published the first details for CVE-2024-43596
A CVSS base score of 6.5 has been assigned.
Detection for the vulnerability has been added to Nessus (209257)
Detection for the vulnerability has been added to Qualys (380734)
EPSS Score was set to: 0.09% (Percentile: 37.9%)
A CVSS base score of 8.8 has been assigned.
CVE-2024-43596 is a critical type confusion vulnerability in Microsoft Edge (Chromium-based) that could enable remote code execution if a victim clicks a malicious link. The exploitation requires user interaction, specifically clicking the link, to allow the attacker to execute code on the renderer process. The provided information does not specify a CVSS score, details on exploitation in the wild, proof-of-concept exploits, mitigations, detections, patches, or downstream impacts on third-party vendors. See article