MSRC-CVE-2024-38177 — Windows App Installer Spoofing Vulnerability

Summary

Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The attacker must convince a user to call Windows App Installer with a specially crafted malicious winget file.

How can I find more information regarding Windows App Installer and Winget?
Please read this page to understand more about App Installer: Installing the App Installer.

Security updates
1.22.11261.0 — https://learn.microsoft.com/en-us/windows/msix/app-installer/install-update-app-installer

Vulnerabilities 1

High 7.8

CVE-2024-38177

Windows App Installer Spoofing Vulnerability

Windows App Installer Spoofing Vulnerability

Microsoft App Installer

Aug 13, 2024

Revision history

2024-08-13 #1
Information published.

References

CVE-2024-38177 Windows App Installer Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38177
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
Common Vulnerability Scoring System
https://www.first.org/cvss