Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The MapURLToZone method could be bypassed by an attacker if the API returned a Zone value of 'Intranet' by passing a URL with a device path to the Lanman redirector device object. The same is true of the WebDav device.
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to prepare the target environment to improve exploit reliability.
Security updates
10.0.17763.5329 — https://support.microsoft.com/help/5034127
10.0.20348.2227 — https://support.microsoft.com/help/5034129
10.0.22000.2713 — https://support.microsoft.com/help/5034121
10.0.19044.3930 — https://support.microsoft.com/help/5034122
10.0.22621.3007 — https://support.microsoft.com/help/5034123
10.0.10240.20402 — https://support.microsoft.com/help/5034134
10.0.14393.6614 — https://support.microsoft.com/help/5034119
6.1.7601.26910 — https://support.microsoft.com/help/5034169
6.1.7601.26910 — https://support.microsoft.com/help/5034167
1.001 — https://support.microsoft.com/help/5034120
6.2.9200.24664 — https://support.microsoft.com/help/5034184
6.3.9600.21765 — https://support.microsoft.com/help/5034171
10.0.25398.643 — https://support.microsoft.com/help/5034130
Vulnerabilities 1
-
High 8.1
Windows HTML Platforms Security Feature Bypass Vulnerability
Windows HTML Platforms Security Feature Bypass Vulnerability
Revision history
-
#2
Updated one or more CVSS scores for the affected products. This is an informational change only.
-
#1
Information published.
References
-
CVE-2024-20652 Windows HTML Platforms Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20652
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss