Skip to content
OpenAdvisories
High MSRC-CVE-2024-20652 1 CVE

Windows HTML Platforms Security Feature Bypass Vulnerability

Published Jan 9, 2024 · Updated Jul 19, 2024 · Revision 2

Summary

Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The MapURLToZone method could be bypassed by an attacker if the API returned a Zone value of 'Intranet' by passing a URL with a device path to the Lanman redirector device object. The same is true of the WebDav device.

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.

Security updates
10.0.17763.5329 — https://support.microsoft.com/help/5034127
10.0.20348.2227 — https://support.microsoft.com/help/5034129
10.0.22000.2713 — https://support.microsoft.com/help/5034121
10.0.19044.3930 — https://support.microsoft.com/help/5034122
10.0.22621.3007 — https://support.microsoft.com/help/5034123
10.0.10240.20402 — https://support.microsoft.com/help/5034134
10.0.14393.6614 — https://support.microsoft.com/help/5034119
6.1.7601.26910 — https://support.microsoft.com/help/5034169
6.1.7601.26910 — https://support.microsoft.com/help/5034167
1.001 — https://support.microsoft.com/help/5034120
6.2.9200.24664 — https://support.microsoft.com/help/5034184
6.3.9600.21765 — https://support.microsoft.com/help/5034171
10.0.25398.643 — https://support.microsoft.com/help/5034130

Vulnerabilities 1

Revision history

  1. #2

    Updated one or more CVSS scores for the affected products. This is an informational change only.

  2. #1

    Information published.

References