CVE-2024-29988KEV · OVERDUECWE-693

SmartScreen Prompt Security Feature Bypass Vulnerability

High · published April 9, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 98.8th percentile for exploit probability.

886
days past CISA
deadline
CVSS v3.1
8.8
EPSS
45%
Percentile
98.8
In the wild
Confirmed
What it is

🚨 A crafty trick lets attackers bypass the SmartScreen protection feature with just a single click! ⚡ It's like a restaurant with a bouncer who only checks IDs at the entrance but ignores what happens inside — once an attacker gets in, they can serve any dish they want without checks! If exploited, this vulnerability allows attackers to completely bypass critical security warnings, putting your system at serious risk. They could potentially execute malicious software without the user ever knowing, leading to data breaches and compromised systems — absolutely devastating!

Put simply

It's like a restaurant with a bouncer who only checks IDs at the entrance but ignores what happens inside — once an attacker gets in, they can serve any dish they want without checks! This vulnerability relates to the SmartScreen filter, where an attacker can manipulate the security prompt, essentially tricking it into thinking a potentially harmful action is safe, thus rendering the feature ineffective.

What to do

If exploited, this vulnerability allows attackers to completely bypass critical security warnings, putting your system at serious risk. They could potentially execute malicious software without the user ever knowing, leading to data breaches and compromised systems — absolutely devastating! To mitigate this issue, ensure your system is updated with the latest security patches that address CVE-2024-29988. Additionally, encourage users to exercise caution and verify the authenticity of any prompts before proceeding with actions. Regularly review your security settings to stay protected! You've got this! By staying vigilant and following these steps, you'll keep your systems secure and user-friendly! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.45151 · 98.8th percentile
Weakness
CWE-693 · Protection Mechanism Failure
Published
2024-04-09T17:00Z
KEV added
2024-04-30 · due 2024-05-21
EPSS history
Timeline
  • 30 APR 00:00Z
    Added to CISA KEV — remediate by May 21
    kev
  • 09 APR 17:00Z
    SmartScreen Prompt Security Feature Bypass Vulnerability
    cvelistv5