Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), integrity (I:H), and availability (A:H). What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could gain high privileges, which include read, write, and delete functionality.
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
The attacker must be authenticated using valid Exchange user credentials.
Security updates
https — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.0.5435.1000 — https://support.microsoft.com/help/5002543
Vulnerabilities 1
-
High 8.8
Microsoft Outlook Remote Code Execution Vulnerability
Microsoft Outlook Remote Code Execution Vulnerability
Revision history
-
#2
Updated FAQs and updated the CVSS score. These are informational changes only.
-
#1
Information published.
References
-
CVE-2024-21378 Microsoft Outlook Remote Code Execution Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21378
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss