CVE-2024-38213: medium-severity vulnerability in Microsoft Windows 10 Version 1507
Windows Mark of the Web Security Feature Bypass Vulnerability
Published · Updated
E-mail alert when it lands in KEV, gets a public PoC or its score goes up.
Prioritize patching. It under exploitation confirmed by CISA.
Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.
A security bypass in Windows allows files downloaded from the internet to lose their safety warning, potentially letting malicious files execute without user caution. This vulnerability undermines a key Windows protection mechanism designed to alert users about untrusted content.
The vulnerability exploits improper handling of the Mark of the Web (MOTW) attribute in Windows, allowing attackers to bypass the security zone enforcement through specially crafted file manipulation. An attacker with the ability to modify or create files on the target system can strip or manipulate MOTW metadata, resulting in execution of potentially malicious content without appropriate security prompts or restrictions.
The full analysis of this CVE is available in Portuguese →
In the same product, most dangerous first.