Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Exploited according to Microsoft, publicly disclosed before the fix — Exploitation Detected. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The attacker would be able to bypass Windows Defender SmartScreen checks and their associated prompts.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have to click on a specially crafted Internet Shortcut (.URL) or a hyperlink pointing to an Internet Shortcut file to be compromised by the attacker.
Security updates
10.0.17763.5122 — https://support.microsoft.com/help/5032196
10.0.20348.2113 — https://support.microsoft.com/help/5032198
10.0.20348.2091 — https://support.microsoft.com/help/5032304
10.0.22000.2600 — https://support.microsoft.com/help/5032192
10.0.19043.3693 — https://support.microsoft.com/help/5032189
10.0.22621.2715 — https://support.microsoft.com/help/5032190
10.0.25398.531 — https://support.microsoft.com/help/5032202
10.0.10240.20308 — https://support.microsoft.com/help/5032199
10.0.14393.6452 — https://support.microsoft.com/help/5032197
6.0.6003.22367 — https://support.microsoft.com/help/5032254
6.0.6003.22367 — https://support.microsoft.com/help/5032248
6.1.7601.26816 — https://support.microsoft.com/help/5032252
6.1.7601.26816 — https://support.microsoft.com/help/5032250
6.2.9200.24569 — https://support.microsoft.com/help/5032247
6.3.9600.21668 — https://support.microsoft.com/help/5032249
Vulnerabilities 1
-
High 8.8
Windows SmartScreen Security Feature Bypass Vulnerability
Windows SmartScreen Security Feature Bypass Vulnerability
KEV Nov 14, 2023
Revision history
-
#2
For informational accuracy, updated the Publicly Disclosed information.
-
#1
Information published.
References
-
CVE-2023-36025 Windows SmartScreen Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36025
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss