Логотип exploitDog
Консоль
Логотип exploitDog

exploitDog

msrc логотип

CVE-2023-36584

Опубликовано: 10 окт. 2023
Источник: msrc
CVSS3: 5.4
EPSS Средний

Описание

Windows Mark of the Web Security Feature Bypass Vulnerability

FAQ

How could an attacker exploit the vulnerability?

To exploit this vulnerability, an attacker could host a file on an attacker-controlled server, then convince a targeted user to download and open the file. This could allow the attacker to interfere with the Mark of the Web functionality.

Please see Additional information about Mark of the Web for further clarification

According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L) and some loss of availability (A:L). What does that mean for this vulnerability?

An attacker can craft a malicious file that would evade Mark of the Web (MOTW) defenses, resulting in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.

Обновления

ПродуктСтатьяОбновление
Windows Server 2008 for 32-bit Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation)
Windows Server 2008 R2 for x64-based Systems Service Pack 1
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation)
Windows Server 2012
Windows Server 2012 (Server Core installation)
Windows Server 2012 R2
Windows Server 2012 R2 (Server Core installation)

Показывать по

Возможность эксплуатации

Publicly Disclosed

No

Exploited

No

Latest Software Release

Exploitation Less Likely

DOS

N/A

EPSS

Процентиль: 95%
0.20094
Средний

5.4 Medium

CVSS3

Связанные уязвимости

CVSS3: 5.4
nvd
почти 2 года назад

Windows Mark of the Web Security Feature Bypass Vulnerability

CVSS3: 5.4
github
почти 2 года назад

Windows Mark of the Web Security Feature Bypass Vulnerability

CVSS3: 5.4
fstec
почти 2 года назад

Уязвимость механизма Mark-of-the-Web (MoTW) операционных систем Windows, позволяющая нарушителю обойти ограничения безопасности

EPSS

Процентиль: 95%
0.20094
Средний

5.4 Medium

CVSS3