CVE-2024-43461KEV · OVERDUECWE-451

Microsoft Windows MSHTML Platform Spoofing Vulnerability

High · published September 10, 2024

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 99.0th percentile for exploit probability.

748
days past CISA
deadline
CVSS v3.1
8.8
EPSS
54%
Percentile
99.0
In the wild
Confirmed
What it is

⚡ Sneaky spoofing at play! This vulnerability in the Windows MSHTML platform could trick users into believing a malicious site is legitimate — like a restaurant using a fake menu to serve you things that aren't on the up-and-up! 🍽️ Think of it like a restaurant pranking you with a fake menu. When you order off that menu, you end up with something completely different than what you expected — potentially harmful! Just like that, this spoofing vulnerability can mislead users into believing they're visiting safe websites when they’re not. An attacker could exploit this flaw to inject malicious code, leading users to visit harmful sites, steal sensitive information, or even execute malicious software without their knowledge. Imagine the chaos if someone's personal info ends up in the wrong hands — not good at all!

Put simply

Think of it like a restaurant pranking you with a fake menu. When you order off that menu, you end up with something completely different than what you expected — potentially harmful! Just like that, this spoofing vulnerability can mislead users into believing they're visiting safe websites when they’re not. This vulnerability hinges on improper validation within the MSHTML platform, allowing attackers to present malicious content disguised as legitimate web pages, effectively bypassing security measures.

What to do

An attacker could exploit this flaw to inject malicious code, leading users to visit harmful sites, steal sensitive information, or even execute malicious software without their knowledge. Imagine the chaos if someone's personal info ends up in the wrong hands — not good at all! Immediate patching is crucial. Update Windows to the latest version that addresses CVE-2024-43461 and ensure that all security configurations are enabled to thwart such exploits. Review and educate users about recognizing phishing attempts as an added layer of protection. You're on this! With a patch and some user education, you'll bolster your defenses and keep the internet safer. 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.54486 · 99.0th percentile
Weakness
CWE-451 · User Interface (UI) Misrepresentation of Critical Information
Published
2024-09-10T21:15Z
KEV added
2024-09-16 · due 2024-10-07
Affected products (23)
ProductVersionsFixed in
microsoft/windows_10_1507< 10.0.10240.2076610.0.10240.20766
microsoft/windows_10_1507< 10.0.10240.2076610.0.10240.20766
microsoft/windows_10_1607< 10.0.14393.733610.0.14393.7336
microsoft/windows_10_1607< 10.0.14393.733610.0.14393.7336
microsoft/windows_10_1809< 10.0.17763.629310.0.17763.6293
microsoft/windows_10_21h2< 10.0.19044.489410.0.19044.4894
microsoft/windows_10_22h2< 10.0.19045.489410.0.19045.4894
microsoft/windows_10_22h2< 10.0.19045.489410.0.19045.4894
microsoft/windows_10_22h2< 10.0.19045.489410.0.19045.4894
microsoft/windows_11_21h2< 10.0.22000.319710.0.22000.3197
microsoft/windows_11_22h2< 10.0.22621.416910.0.22621.4169
microsoft/windows_11_23h2< 10.0.22621.416910.0.22621.4169
microsoft/windows_11_23h2< 10.0.22631.416910.0.22631.4169
microsoft/windows_11_24h2< 10.0.26100.174210.0.26100.1742
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2008all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2012all versions—
microsoft/windows_server_2016< 10.0.14393.733610.0.14393.7336
microsoft/windows_server_2019< 10.0.17763.629310.0.17763.6293
microsoft/windows_server_2022< 10.0.20348.270010.0.20348.2700
microsoft/windows_server_2022_23h2< 10.0.25398.112810.0.25398.1128
References (2)
EPSS history
Timeline
  • 16 SEP 00:00Z
    Added to CISA KEV — remediate by Oct 7
    kev
  • 10 SEP 16:54Z
    Windows MSHTML Platform Spoofing Vulnerability
    cvelistv5