Office Spoofing Vulnerability Allows Attackers to Execute Malicious Code

CVE-2024-38200

6.5MEDIUM

Key Information

Vendor: Microsoft
Status: Microsoft Office 2019; Microsoft 365 Apps For Enterprise; Microsoft Office Ltsc 2021; Microsoft Office 2016
Vendor: CVE Published:; 12 August 2024

Badges

👾 Exploit Exists🔴 Public PoC📰 News Worthy

Summary

The Office Spoofing Vulnerability (CVE-2024-38200) has been discovered and exploited in Microsoft Office 2016, Microsoft Office LTSC 2021, Microsoft 365 Apps for Enterprise, and Microsoft Office 2019. It is a zero-day flaw that allows unauthorized disclosure of sensitive information when successfully exploited. The exploit can be enacted through a specially crafted file hosted on a compromised or attacking website, and would generally require user interaction to be successful. A patch is expected on August 13, but a mitigation solution has been identified and implemented. Microsoft is also working on addressing two other zero-day vulnerabilities. This could be part of a larger trend of zero-day exploits targeting Microsoft software, underscoring the importance of timely patching and security awareness.

Affected Version(s)

Microsoft Office 2019 < 19.0.0

Microsoft 365 Apps for Enterprise < 16.0.1

Microsoft Office LTSC 2021 < 16.0.1

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2024-38200
Created by passtheticket

News Articles

CybersecurityNews

CVE-2024-38200

PoC Exploit Released for Microsoft Office 0-day Flaw - CVE-2024-38200

Security researchers have released a proof-of-concept (PoC) exploit for the recently disclosed Microsoft Office vulnerability CVE-2024-38200, which could allow attackers to capture users' NTLMv2 hashes.

2 months ago