Medium · published September 10, 2024
CVSS calls it medium at 5.4. It is confirmed in active exploitation. It sits in the 95.6th percentile for exploit probability.
⚠️ A crafty bypass in the Windows Mark of the Web (MoW) security feature poses a sneaky threat to your system! Think of this as a restaurant that let’s diners walk in without checking their reservation — with a little finesse, someone could slip through and enjoy a meal meant for someone else. An attacker could exploit this vulnerability to bypass security measures, potentially allowing them to execute malicious content that should be blocked. This means your system could be exposed to a world of harmful downloads or data breaches, which is definitely not the kind of surprise anyone wants!
Think of this as a restaurant that let’s diners walk in without checking their reservation — with a little finesse, someone could slip through and enjoy a meal meant for someone else. This vulnerability allows the bypassing of the Mark of the Web security feature, which normally tags files downloaded from the internet to warn users about their potential danger. By exploiting this weakness, attackers can execute files without the usual security prompts.
An attacker could exploit this vulnerability to bypass security measures, potentially allowing them to execute malicious content that should be blocked. This means your system could be exposed to a world of harmful downloads or data breaches, which is definitely not the kind of surprise anyone wants! To safeguard your systems, ensure you update Windows to the latest version where this issue is patched. Regularly audit your security settings to ensure no bypasses have been exploited, and consider deploying additional security measures like antivirus or endpoint detection software. You've got this! Follow these steps and you'll be on your way to reinforcing your security! 🛡️
| Product | Versions | Fixed in |
|---|---|---|
| microsoft/windows_10_1507 | < 10.0.10240.20766 | 10.0.10240.20766 |
| microsoft/windows_10_1507 | < 10.0.10240.20766 | 10.0.10240.20766 |
| microsoft/windows_10_1607 | < 10.0.14393.7336 | 10.0.14393.7336 |
| microsoft/windows_10_1607 | < 10.0.14393.7336 | 10.0.14393.7336 |
| microsoft/windows_10_1809 | < 10.0.17763.6293 | 10.0.17763.6293 |
| microsoft/windows_10_1809 | < 10.0.17763.6293 | 10.0.17763.6293 |
| microsoft/windows_10_21h2 | < 10.0.19044.4894 | 10.0.19044.4894 |
| microsoft/windows_10_22h2 | < 10.0.19045.4894 | 10.0.19045.4894 |
| microsoft/windows_11_21h2 | < 10.0.22000.3197 | 10.0.22000.3197 |
| microsoft/windows_11_22h2 | < 10.0.22621.4169 | 10.0.22621.4169 |
| microsoft/windows_11_23h2 | < 10.0.22631.4169 | 10.0.22631.4169 |
| microsoft/windows_11_24h2 | < 10.0.26100.1742 | 10.0.26100.1742 |
| microsoft/windows_11_24h2 | < 10.0.26100.1742 | 10.0.26100.1742 |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2008 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2012 | all versions | — |
| microsoft/windows_server_2016 | < 10.0.14393.7336 | 10.0.14393.7336 |
| microsoft/windows_server_2019 | < 10.0.17763.6293 | 10.0.17763.6293 |
| microsoft/windows_server_2022 | < 10.0.20348.2700 | 10.0.20348.2700 |
| microsoft/windows_server_2022_23h2 | < 10.0.25398.1128 | 10.0.25398.1128 |