Microsoft CVE Summary

This report contains detail for the following vulnerabilities:

Tag CVE ID CVE Title Severity
Azure Data Science Virtual Machines CVE-2024-37325 Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability Important
Azure File Sync CVE-2024-35253 Microsoft Azure File Sync Elevation of Privilege Vulnerability Important
Azure Monitor CVE-2024-35254 Azure Monitor Agent Elevation of Privilege Vulnerability Important
Azure SDK CVE-2024-35255 Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability Important
Azure Storage Library CVE-2024-35252 Azure Storage Movement Client Library Denial of Service Vulnerability Important
Dynamics Business Central CVE-2024-35248 Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability Important
Dynamics Business Central CVE-2024-35249 Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability Important
Microsoft Dynamics CVE-2024-35263 Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability Important
Microsoft Edge (Chromium-based) CVE-2024-5498 Chromium: CVE-2024-5498 Use after free in Presentation API Unknown
Microsoft Edge (Chromium-based) CVE-2024-5493 Chromium: CVE-2024-5493 Heap buffer overflow in WebRTC Unknown
Microsoft Edge (Chromium-based) CVE-2024-5497 Chromium: CVE-2024-5497 Out of bounds memory access in Keyboard Inputs Unknown
Microsoft Edge (Chromium-based) CVE-2024-5495 Chromium: CVE-2024-5495 Use after free in Dawn Unknown
Microsoft Edge (Chromium-based) CVE-2024-5499 Chromium: CVE-2024-5499 Out of bounds write in Streams API Unknown
Microsoft Edge (Chromium-based) CVE-2024-5494 Chromium: CVE-2024-5494 Use after free in Dawn Unknown
Microsoft Edge (Chromium-based) CVE-2024-5496 Chromium: CVE-2024-5496 Use after free in Media Session Unknown
Microsoft Office CVE-2024-30101 Microsoft Office Remote Code Execution Vulnerability Important
Microsoft Office CVE-2024-30104 Microsoft Office Remote Code Execution Vulnerability Important
Microsoft Office Outlook CVE-2024-30103 Microsoft Outlook Remote Code Execution Vulnerability Important
Microsoft Office SharePoint CVE-2024-30100 Microsoft SharePoint Server Remote Code Execution Vulnerability Important
Microsoft Office Word CVE-2024-30102 Microsoft Office Remote Code Execution Vulnerability Important
Microsoft Streaming Service CVE-2024-30090 Microsoft Streaming Service Elevation of Privilege Vulnerability Important
Microsoft Streaming Service CVE-2024-30089 Microsoft Streaming Service Elevation of Privilege Vulnerability Important
Microsoft WDAC OLE DB provider for SQL CVE-2024-30077 Windows OLE Remote Code Execution Vulnerability Important
Microsoft Windows CVE-2023-50868 MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU Important
Microsoft Windows Speech CVE-2024-30097 Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability Important
Visual Studio CVE-2024-30052 Visual Studio Remote Code Execution Vulnerability Important
Visual Studio CVE-2024-29060 Visual Studio Elevation of Privilege Vulnerability Important
Visual Studio CVE-2024-29187 GitHub: CVE-2024-29187 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM Important
Windows Cloud Files Mini Filter Driver CVE-2024-30085 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important
Windows Container Manager Service CVE-2024-30076 Windows Container Manager Service Elevation of Privilege Vulnerability Important
Windows Cryptographic Services CVE-2024-30096 Windows Cryptographic Services Information Disclosure Vulnerability Important
Windows DHCP Server CVE-2024-30070 DHCP Server Service Denial of Service Vulnerability Important
Windows Distributed File System (DFS) CVE-2024-30063 Windows Distributed File System (DFS) Remote Code Execution Vulnerability Important
Windows Event Logging Service CVE-2024-30072 Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability Important
Windows Kernel CVE-2024-30068 Windows Kernel Elevation of Privilege Vulnerability Important
Windows Kernel CVE-2024-30064 Windows Kernel Elevation of Privilege Vulnerability Important
Windows Kernel-Mode Drivers CVE-2024-30084 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Important
Windows Kernel-Mode Drivers CVE-2024-35250 Windows Kernel-Mode Driver Elevation of Privilege Vulnerability Important
Windows Link Layer Topology Discovery Protocol CVE-2024-30075 Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability Important
Windows Link Layer Topology Discovery Protocol CVE-2024-30074 Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability Important
Windows NT OS Kernel CVE-2024-30099 Windows Kernel Elevation of Privilege Vulnerability Important
Windows NT OS Kernel CVE-2024-30088 Windows Kernel Elevation of Privilege Vulnerability Important
Windows Perception Service CVE-2024-35265 Windows Perception Service Elevation of Privilege Vulnerability Important
Windows Remote Access Connection Manager CVE-2024-30069 Windows Remote Access Connection Manager Information Disclosure Vulnerability Important
Windows Routing and Remote Access Service (RRAS) CVE-2024-30095 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability Important
Windows Routing and Remote Access Service (RRAS) CVE-2024-30094 Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability Important
Windows Server Service CVE-2024-30062 Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability Important
Windows Server Service CVE-2024-30080 Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability Critical
Windows Standards-Based Storage Management Service CVE-2024-30083 Windows Standards-Based Storage Management Service Denial of Service Vulnerability Important
Windows Storage CVE-2024-30093 Windows Storage Elevation of Privilege Vulnerability Important
Windows Themes CVE-2024-30065 Windows Themes Denial of Service Vulnerability Important
Windows Wi-Fi Driver CVE-2024-30078 Windows Wi-Fi Driver Remote Code Execution Vulnerability Important
Windows Win32 Kernel Subsystem CVE-2024-30086 Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability Important
Windows Win32K - GRFX CVE-2024-30087 Win32k Elevation of Privilege Vulnerability Important
Windows Win32K - GRFX CVE-2024-30091 Win32k Elevation of Privilege Vulnerability Important
Windows Win32K - GRFX CVE-2024-30082 Win32k Elevation of Privilege Vulnerability Important
Winlogon CVE-2024-30067 Winlogon Elevation of Privilege Vulnerability Important
Winlogon CVE-2024-30066 Winlogon Elevation of Privilege Vulnerability Important

CVE-2024-30069 - Windows Remote Access Connection Manager Information Disclosure Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30069
MITRE
NVD		 CVE Title: Windows Remote Access Connection Manager Information Disclosure Vulnerability
Description:
Unknown
FAQ:

What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30069
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Information Disclosure None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30069 George Hughey with MSRC Vulnerabilities & Mitigations

CVE-2024-30070 - DHCP Server Service Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30070
MITRE
NVD		 CVE Title: DHCP Server Service Denial of Service Vulnerability
Description:
Unknown
FAQ:
None
Mitigations:

Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30070
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows Server 2012 5039260 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30070 YanZiShuang@BigCJTeam of cyberkl

CVE-2024-30072 - Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30072
MITRE
NVD		 CVE Title: Microsoft Event Trace Log File Parsing Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker must send the user a malicious file and convince them to open it.


According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30072
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30072 Laith AL-Satari

CVE-2024-30074 - Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30074
MITRE
NVD		 CVE Title: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?

Exploiting this vulnerability requires an attacker to be within proximity of the target system to send and receive radio transmissions.


How could an attacker exploit the vulnerability?

An unauthenticated attacker could send a malicious networking packet to an adjacent system where a user is running the Network Map functionality over a WiFi networking adapter, which could enable remote code execution.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30074
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.2
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.2
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.2
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.2
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.2
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.2
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30074 Wei in Kunlun Lab with Cyber KunLun

CVE-2024-30075 - Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30075
MITRE
NVD		 CVE Title: Windows Link Layer Topology Discovery Protocol Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?

Exploiting this vulnerability requires an attacker to be within proximity of the target system to send and receive radio transmissions.


How could an attacker exploit the vulnerability?

An unauthenticated attacker could send a malicious networking packet to an adjacent system where a user is running the Network Map functionality over a WiFi networking adapter, which could enable remote code execution.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30075
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30075 Wei in Kunlun Lab with Cyber KunLun

CVE-2024-30076 - Windows Container Manager Service Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30076
MITRE
NVD		 CVE Title: Windows Container Manager Service Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N) but have major impact on integrity (I:H) and on availability (A:H). What does that mean for this vulnerability?

This vulnerability does not allow disclosure of any confidential information, but could allow an attacker to delete data that could include data that results in the service being unavailable.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30076
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 6.8
Temporal: 5.9
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30076 Jakub Štrom

CVE-2024-30077 - Windows OLE Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30077
MITRE
NVD		 CVE Title: Windows OLE Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

How could an attacker exploit this vulnerability?

An attacker could exploit the vulnerability by tricking an authenticated user (UI:R) into attempting to connect to a malicious SQL server database via a connection driver (for example: OLE DB or OLEDB as applicable). This could result in the database returning malicious data that could cause arbitrary code execution on the client.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30077
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Remote Code Execution None Base: 8.0
Temporal: 7.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30077 bee13oy with Cyber Kunlun Lab


Anonymous

CVE-2024-30078 - Windows Wi-Fi Driver Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30078
MITRE
NVD		 CVE Title: Windows Wi-Fi Driver Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is adjacent (AV:A). What does that mean for this vulnerability?

Exploiting this vulnerability requires an attacker to be within proximity of the target system to send and receive radio transmissions.


How could an attacker exploit the vulnerability?

An unauthenticated attacker could send a malicious networking packet to an adjacent system that is employing a Wi-Fi networking adapter, which could enable remote code execution.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30078
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:A/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30078 Wei in Kunlun Lab with Cyber KunLun

CVE-2024-30080 - Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30080
MITRE
NVD		 CVE Title: Microsoft Message Queuing (MSMQ) Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

How could an attacker exploit the vulnerability?

To exploit this vulnerability, an attacker would need to send a specially crafted malicious MSMQ packet to a MSMQ server. This could result in remote code execution on the server side.


Mitigations:

Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Critical Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30080
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Critical Remote Code Execution None Base: 9.8
Temporal: 8.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30080 k0shl with Kunlun Lab

CVE-2024-30082 - Win32k Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30082
MITRE
NVD		 CVE Title: Win32k Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30082
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30082 Marcin Wiazowski with Trend Micro Zero Day Initiative

CVE-2024-35250 - Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35250
MITRE
NVD		 CVE Title: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35250
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35250 Angelboy (@scwuaptx) from DEVCORE Research Team with Trend Micro Zero Day Initiative


Angelboy (@scwuaptx) with DEVCORE

CVE-2024-35255 - Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35255
MITRE
NVD		 CVE Title: Azure Identity Libraries and Microsoft Authentication Library Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited the vulnerability could elevate privileges and read any file on the file system with SYSTEM access permissions.


According to the CVSS metric, Integrity and Availability impact is None (I:N/A:N). What does that mean for this vulnerability?

An attacker who successfully exploits this vulnerability can only obtain read access to the system files by exploiting this vulnerability. The attacker cannot perform write or delete operations on the files.


Which credential types provided by the Azure Identity client library are affected?

The vulnerability exists in the following credential types:

  • DefaultAzureCredential
  • ManagedIdentityCredential

Which credential types provided by the Azure Identity client library are affected?

The vulnerability exists in the following credential types:


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35255
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Azure Identity Library for .NET Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Azure Identity Library for C++ Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Azure Identity Library for Go Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Azure Identity Library for Java Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Azure Identity Library for JavaScript Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Azure Identity Library for Python Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Authentication Library (MSAL) for .NET Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Authentication Library (MSAL) for Java Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Authentication Library (MSAL) for Node.js Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Authentication Library (MSAL) for Python Release Notes (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35255 Vladimir Abramzon with Microsoft


Eli Arbel with Microsoft

CVE-2023-50868 - MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2023-50868
MITRE
NVD		 CVE Title: MITRE: CVE-2023-50868 NSEC3 closest encloser proof can exhaust CPU
Description:
Unknown
FAQ:

Why is the MITRE Corporation the assigning CNA (CVE Numbering Authority)?

CVE-2023-50868 is regarding a vulnerability in DNSSEC validation where an attacker could exploit standard DNSSEC protocols intended for DNS integrity by using excessive resources on a resolver, causing a denial of service for legitimate users. MITRE created this CVE on their behalf.

Please see CVE-2023-50868 for more information.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A Yes No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2023-50868
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows Server 2012 5039260 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2023-50868 Elias Heftrig, Haya Schulmann, Niklas Vogel, and Michael Waidner from the German National Research Center for Applied Cybersecurity ATHENE

CVE-2024-29187 - GitHub: CVE-2024-29187 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-29187
MITRE
NVD		 CVE Title: GitHub: CVE-2024-29187 WiX Burn-based bundles are vulnerable to binary hijack when run as SYSTEM
Description:
Unknown
FAQ:

According to the CVSS metric, user interaction is required (UI:R) and privileges required  is low (PR:L). What does that mean for this vulnerability?

An authorized attacker must send the user a malicious file and convince the user to open it.


Why is this GitHub CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Wix Toolset software which is consumed by Microsoft Visual Studio. It is being documented in the Security Update Guide to announce that the latest builds of Visual Studio are no longer vulnerable. Please see Security Update Guide Supports CVEs Assigned by Industry Partners for more information.


What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-29187
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Release Notes (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Release Notes (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.10 Release Notes (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.4 Release Notes (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.6 Release Notes (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.8 Release Notes (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-29187 Naceri with MSRC Vulnerabilities & Mitigations

CVE-2024-5493 - Chromium: CVE-2024-5493 Heap buffer overflow in WebRTC

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-5493
MITRE
NVD		 CVE Title: Chromium: CVE-2024-5493 Heap buffer overflow in WebRTC
Description:

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.


FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version
Stable 125.0.2535.85 6/3/2024 125.0.6422.141/.142

Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-03T18:29:54    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found N/A Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-5493
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-5493 None

CVE-2024-5498 - Chromium: CVE-2024-5498 Use after free in Presentation API

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-5498
MITRE
NVD		 CVE Title: Chromium: CVE-2024-5498 Use after free in Presentation API
Description:

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.


FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version
Stable 125.0.2535.85 6/3/2024 125.0.6422.141/.142

Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-03T18:30:07    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found N/A Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-5498
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-5498 None

CVE-2024-5496 - Chromium: CVE-2024-5496 Use after free in Media Session

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-5496
MITRE
NVD		 CVE Title: Chromium: CVE-2024-5496 Use after free in Media Session
Description:

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.


FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version
Stable 125.0.2535.85 6/3/2024 125.0.6422.141/.142

Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-03T18:30:03    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found N/A Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-5496
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-5496 None

CVE-2024-5499 - Chromium: CVE-2024-5499 Out of bounds write in Streams API

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-5499
MITRE
NVD		 CVE Title: Chromium: CVE-2024-5499 Out of bounds write in Streams API
Description:

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.


FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version
Stable 125.0.2535.85 6/3/2024 125.0.6422.141/.142

Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-03T18:30:09    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found N/A Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-5499
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-5499 None

CVE-2024-5494 - Chromium: CVE-2024-5494 Use after free in Dawn

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-5494
MITRE
NVD		 CVE Title: Chromium: CVE-2024-5494 Use after free in Dawn
Description:

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.


FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version
Stable 125.0.2535.85 6/3/2024 125.0.6422.141/.142

Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-03T18:29:59    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found N/A Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-5494
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-5494 None

CVE-2024-5497 - Chromium: CVE-2024-5497 Out of bounds memory access in Keyboard Inputs

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-5497
MITRE
NVD		 CVE Title: Chromium: CVE-2024-5497 Out of bounds memory access in Keyboard Inputs
Description:

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.


FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version
Stable 125.0.2535.85 6/3/2024 125.0.6422.141/.142

Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-03T18:30:05    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found N/A Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-5497
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-5497 None

CVE-2024-5495 - Chromium: CVE-2024-5495 Use after free in Dawn

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-5495
MITRE
NVD		 CVE Title: Chromium: CVE-2024-5495 Use after free in Dawn
Description:

This CVE was assigned by Chrome. Microsoft Edge (Chromium-based) ingests Chromium, which addresses this vulnerability. Please see Google Chrome Releases for more information.


FAQ:

Why is this Chrome CVE included in the Security Update Guide?

The vulnerability assigned to this CVE is in Chromium Open Source Software (OSS) which is consumed by Microsoft Edge (Chromium-based). It is being documented in the Security Update Guide to announce that the latest version of Microsoft Edge (Chromium-based) is no longer vulnerable.

How can I see the version of the browser?

  1. In your Microsoft Edge browser, click on the 3 dots (...) on the very right-hand side of the window
  2. Click on Help and Feedback
  3. Click on About Microsoft Edge

Microsoft Edge Channel Microsoft Edge Version Date Released Based on Chromium Version
Stable 125.0.2535.85 6/3/2024 125.0.6422.141/.142

Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-03T18:30:01    

Information published.


 Unknown Unknown

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Not Found Not Found N/A Not Found Not Found

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-5495
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Edge (Chromium-based) Release Notes (Security Update) Unknown Unknown None Base: N/A
Temporal: N/A
Vector: N/A
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-5495 None

CVE-2024-29060 - Visual Studio Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-29060
MITRE
NVD		 CVE Title: Visual Studio Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, user interaction is required (UI:R) and privileges required is Low (PR:L). What does that mean for this vulnerability?

An authorized attacker could create a malicious extension and then wait for an authenticated user to create a new Visual Studio project that uses that extension. The result is that the attacker could gain the privileges of the user.


What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could gain administrator privileges.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment and take additional actions prior to exploitation to prepare the target environment.


According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of availability (A:L)? What does that mean for this vulnerability?

The performance can be interrupted and/or reduced, but the attacker cannot fully deny service.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-29060
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Release Notes (Security Update) Important Elevation of Privilege None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Release Notes (Security Update) Important Elevation of Privilege None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.10 Release Notes (Security Update) Important Elevation of Privilege None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.4 Release Notes (Security Update) Important Elevation of Privilege None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.6 Release Notes (Security Update) Important Elevation of Privilege None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.8 Release Notes (Security Update) Important Elevation of Privilege None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:N/AC:H/PR:L/UI:R/S:U/C:H/I:H/A:L/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-29060 Filip Dragović

CVE-2024-30062 - Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30062
MITRE
NVD		 CVE Title: Windows Standards-Based Storage Management Service Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

A user would have to restart the compromised service on the server to trigger the vulnerability.


According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30062
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30062 k0shl with Kunlun Lab

CVE-2024-30063 - Windows Distributed File System (DFS) Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30063
MITRE
NVD		 CVE Title: Windows Distributed File System (DFS) Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

This vulnerability could be triggered when a user connects a Windows client to a malicious server.


According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to have obtained low privileged code execution on target host first.


According to the CVSS score, the attack vector is adjacent (AV:A). What does this mean for this vulnerability?

Exploiting this vulnerability requires an attacker to be on the same network segment as the target system. Traffic associated with exploitation of this vulnerability is not routable and is bound to the data link layer of the OSI model.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30063
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Remote Code Execution None Base: 6.7
Temporal: 5.8
Vector: CVSS:3.1/AV:A/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:N/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30063 Anonymous

CVE-2024-30064 - Windows Kernel Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30064
MITRE
NVD		 CVE Title: Windows Kernel Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

This vulnerability could lead to a contained execution environment escape. Please refer to AppContainer Isolation for more information.


How could an attacker exploit this vulnerability?

To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.


What privileges could an attacker gain with a successful exploitation?

An attacker who successfully exploited this vulnerability could gain unauthorized access to system resources, potentially allowing them to perform actions with the same privileges as the compromised process.

This could lead to further system compromise and unauthorized actions within the network.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30064
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30064 k0shl with Kunlun Lab

CVE-2024-30065 - Windows Themes Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30065
MITRE
NVD		 CVE Title: Windows Themes Denial of Service Vulnerability
Description:
Unknown
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30065
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Denial of Service None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30065 goodbyeselene

CVE-2024-30066 - Winlogon Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30066
MITRE
NVD		 CVE Title: Winlogon Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of integrity (I:H). What does that mean for this vulnerability?

An authenticated attacker could replace valid file content with specially crafted file content.


What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could gain specific limited SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30066
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30066 goodbyeselene

CVE-2024-30067 - Winlogon Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30067
MITRE
NVD		 CVE Title: Winlogon Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could gain specific limited SYSTEM privileges.


According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of integrity (I:H). What does that mean for this vulnerability?

An authenticated attacker could replace valid file content with specially crafted file content.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30067
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30067 goodbyeselene

CVE-2024-30068 - Windows Kernel Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30068
MITRE
NVD		 CVE Title: Windows Kernel Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?

In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment.


How could an attacker exploit this vulnerability?

To exploit this vulnerability, an attacker would first have to log on to the system. An attacker could then run a specially crafted application that could exploit the vulnerability and take control of an affected system.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30068
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30068 Anonymous

CVE-2024-30083 - Windows Standards-Based Storage Management Service Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30083
MITRE
NVD		 CVE Title: Windows Standards-Based Storage Management Service Denial of Service Vulnerability
Description:
Unknown
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30083
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30083 Azure Yang with Kunlun Lab

CVE-2024-30084 - Windows Kernel-Mode Driver Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30084
MITRE
NVD		 CVE Title: Windows Kernel-Mode Driver Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30084
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30084 Angelboy (@scwuaptx) from DEVCORE Research Team with Trend Micro Zero Day Initiative

CVE-2024-30085 - Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30085
MITRE
NVD		 CVE Title: Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30085
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30085 Gwangun Jung(@pr0ln) and Junoh Lee(@bbbig12) at Theori(@theori_io) with Trend Micro Zero Day Initiative


Alex Birnberg for TyphoonPWN24


Anonymous with SSD Secure Disclosure

CVE-2024-30086 - Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30086
MITRE
NVD		 CVE Title: Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30086
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30086 Bruno Pujos from REverse Tactics with Trend Micro Zero Day Initiative

CVE-2024-30087 - Win32k Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30087
MITRE
NVD		 CVE Title: Win32k Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited the vulnerability?

The attacker would gain the rights of the user that is running the affected application.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30087
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30087 Marcin Wiazowski with Trend Micro Zero Day Initiative

CVE-2024-30088 - Windows Kernel Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30088
MITRE
NVD		 CVE Title: Windows Kernel Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30088
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30088 Emma Kirkpatrick (@carrot_c4k3) working with Trend Micro Zero Day Initiative

CVE-2024-30089 - Microsoft Streaming Service Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30089
MITRE
NVD		 CVE Title: Microsoft Streaming Service Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30089
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30089 Valentina Palmiotti, IBM X-Force with Trend Micro Zero Day Initiative

CVE-2024-30090 - Microsoft Streaming Service Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30090
MITRE
NVD		 CVE Title: Microsoft Streaming Service Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30090
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30090 Angelboy (@scwuaptx) with DEVCORE

CVE-2024-30091 - Win32k Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30091
MITRE
NVD		 CVE Title: Win32k Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited the vulnerability?

The attacker would gain the rights of the user that is running the affected application.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30091
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.8
Temporal: 7.0
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30091 Tobias Klein

CVE-2024-30093 - Windows Storage Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30093
MITRE
NVD		 CVE Title: Windows Storage Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


According to the CVSS metrics, user interaction is required (UI:R) and privileges required is low (PR:L). What does that mean for this vulnerability?

An authenticated attacker would need to perform specific actions on a vulnerable system, then convince another user on that system to interact with the Volume Shadow Copy functionality.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30093
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30093 Or Yair with SafeBreach

CVE-2024-30094 - Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30094
MITRE
NVD		 CVE Title: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30094
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30094 Anonymous

CVE-2024-30095 - Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30095
MITRE
NVD		 CVE Title: Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30095
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 5039245 (Monthly Rollup)
5039266 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2008 R2 for x64-based Systems Service Pack 1 (Server Core installation) 5039289 (Monthly Rollup)
5039274 (Security Only)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 (Server Core installation) 5039260 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2012 R2 (Server Core installation) 5039294 (Monthly Rollup) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30095 Anonymous

CVE-2024-30096 - Windows Cryptographic Services Information Disclosure Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30096
MITRE
NVD		 CVE Title: Windows Cryptographic Services Information Disclosure Vulnerability
Description:
Unknown
FAQ:

What type of information could be disclosed by this vulnerability?

The type of information that could be disclosed if an attacker successfully exploited this vulnerability is Windows cryptographic secrets.


What type of information could be disclosed by this vulnerability?

An attacker who successfully exploited this vulnerability could disclose sensitive information such as KeyGuard (KG) keys, which are intended to be per-boot and used to protect sensitive data.

If an attacker can persist these keys, they could potentially decrypt any information that was encrypted with the KG key, leading to the exposure of a wide range of sensitive and confidential information.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30096
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Information Disclosure None Base: 5.5
Temporal: 4.8
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30096 Brandon Zhang and Mohsen Mohammadi with Microsoft

CVE-2024-30097 - Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30097
MITRE
NVD		 CVE Title: Microsoft Speech Application Programming Interface (SAPI) Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, user interaction is required (UI:R) and privileges required are none (PR:N). What does that mean for this vulnerability?

An unauthorized attacker must wait for a user to initiate a connection.


How could an attacker exploit this vulnerability?

An attacker could exploit a double free vulnerability within the OS SAPI component to cause a denial of service or execute arbitrary code, compromising system integrity and availability.


According to the CVSS metric, the attack vector is network (AV:N) and the user interaction is required (UI:R). What is the target context of the remote code execution?

This attack requires an authenticated client to click a link in order in for an unauthenticated attacker to obtain remote code execution.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Exploitation Less Likely N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30097
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30097 None

CVE-2024-30099 - Windows Kernel Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30099
MITRE
NVD		 CVE Title: Windows Kernel Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited this vulnerability?

An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation More Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30099
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 for 32-bit Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 for x64-based Systems 5039225 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1607 for 32-bit Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1607 for x64-based Systems 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2016 (Server Core installation) 5039214 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022 (Server Core installation) 5039227 (Security Update)
5039330 (Security Hotpatch Update)		 Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes
Windows Server 2022, 23H2 Edition (Server Core installation) 5039236 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.3
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30099 George Hughey with MSRC Vulnerabilities and Mitigations

CVE-2024-30100 - Microsoft SharePoint Server Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30100
MITRE
NVD		 CVE Title: Microsoft SharePoint Server Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30100
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft SharePoint Enterprise Server 2016 5002604 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft SharePoint Server 2019 5002602 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft SharePoint Server Subscription Edition 5002603 (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30100 cjM00n & Edwardzpeng

CVE-2024-30101 - Microsoft Office Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30101
MITRE
NVD		 CVE Title: Microsoft Office Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

Successful exploitation of this vulnerability requires a user to open a malicious email with an affected version of Microsoft Outlook and then perform specific actions to trigger the vulnerability.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


Is the Preview Pane an attack vector for this vulnerability?

Yes. The Preview Pane is an attack vector, but additional user interaction is required.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30101
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office 2016 (32-bit edition) 5002591 (Security Update)
5002575 (Security Update)		 Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Office 2016 (64-bit edition) 5002591 (Security Update)
5002575 (Security Update)		 Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30101 849db8e253fb723f1bb056416bce0922

CVE-2024-30102 - Microsoft Office Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30102
MITRE
NVD		 CVE Title: Microsoft Office Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.


Is the Preview Pane an attack vector for this vulnerability?

No, the Preview Pane is not an attack vector.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30102
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30102 Quan Jin with DBAPPSecurity WeBin Lab

CVE-2024-30103 - Microsoft Outlook Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30103
MITRE
NVD		 CVE Title: Microsoft Outlook Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

Is the Preview Pane an attack vector for this vulnerability?

Yes, the Preview Pane is an attack vector.


According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

The attacker must be authenticated using valid Exchange user credentials.


How could an attacker exploit this vulnerability?

An attacker who successfully exploited this vulnerability could bypass Outlook registry block lists and enable the creation of malicious DLL files.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30103
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Outlook 2016 (32-bit edition) 5002600 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Outlook 2016 (64-bit edition) 5002600 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30103 Shmuel Uzan with Morphisec


Michael Gorelik with Morphisec

CVE-2024-30104 - Microsoft Office Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30104
MITRE
NVD		 CVE Title: Microsoft Office Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally. This means an attacker or victim needs to execute code from the local machine to exploit the vulnerability.


According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?

An attacker must send the user a malicious file and convince them to open it.


Is the Preview Pane an attack vector for this vulnerability?

No, the Preview Pane is not an attack vector.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30104
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft 365 Apps for Enterprise for 32-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft 365 Apps for Enterprise for 64-bit Systems Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office 2016 (32-bit edition) 5002591 (Security Update)
5002575 (Security Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Office 2016 (64-bit edition) 5002591 (Security Update)
5002575 (Security Update)		 Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Office 2019 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office 2019 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office LTSC 2021 for 32-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No
Microsoft Office LTSC 2021 for 64-bit editions Click to Run (Security Update) Important Remote Code Execution None Base: 7.8
Temporal: 6.8
Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 No

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30104 Luke Papandrea, Microsoft Corporation

CVE-2024-35248 - Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35248
MITRE
NVD		 CVE Title: Microsoft Dynamics 365 Business Central Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metrics, successful exploitation of this vulnerability could lead to minor loss of confidentiality (C:L), integrity (I:L) and availability (A:L). What does that mean for this vulnerability?

While we cannot rule out the impact to Confidentiality, Integrity, and Availability, the ability to exploit this vulnerability by itself is limited. An attacker would need to combine this with other vulnerabilities to perform an attack.


What privileges could be gained by an attacker who successfully exploited the vulnerability?

The attacker would gain the rights of the user that is running the affected application.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35248
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Dynamics 365 Business Central 2023 Release Wave 1 5038529 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2023 Release Wave 2 5038530 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2024 Release Wave 1 5038531 (Security Update) Important Elevation of Privilege None Base: 7.3
Temporal: 6.4
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35248 Dr. Florian Hauser @frycos with CODE WHITE GmbH

CVE-2024-35249 - Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35249
MITRE
NVD		 CVE Title: Microsoft Dynamics 365 Business Central Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35249
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Dynamics 365 Business Central 2023 Release Wave 1 5038529 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2023 Release Wave 2 5038530 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe
Microsoft Dynamics 365 Business Central 2024 Release Wave 1 5038531 (Security Update) Important Remote Code Execution None Base: 8.8
Temporal: 7.7
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35249 Dr. Florian Hauser @frycos with CODE WHITE GmbH

CVE-2024-35252 - Azure Storage Movement Client Library Denial of Service Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35252
MITRE
NVD		 CVE Title: Azure Storage Movement Client Library Denial of Service Vulnerability
Description:
Unknown
FAQ:
None
Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Denial of Service

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35252
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Azure Storage Movement Client Library for .NET Release Notes (Security Update) Important Denial of Service None Base: 7.5
Temporal: 6.5
Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35252 Anonymous

CVE-2024-35253 - Microsoft Azure File Sync Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35253
MITRE
NVD		 CVE Title: Microsoft Azure File Sync Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.


What privileges could be gained by an attacker who successfully exploited the vulnerability?

Exploiting this vulnerability would allow the attacker to perform arbitrary deletion of files that are not accessible to unprivileged users on the victim machine.


According to the CVSS metric, user interaction is Required (UI:R). What does that mean for this vulnerability?

The successful exploitation of this vulnerability requires a user with administrator privileges to perform specific operations on the endpoint targeted by the attacker.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35253
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Azure File Sync v16.0 5039814 (Security Update) Important Elevation of Privilege None Base: 4.4
Temporal: 4.2
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C
 Maybe
Azure File Sync v17.0 5039814 (Security Update) Important Elevation of Privilege None Base: 4.4
Temporal: 4.2
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C
 Maybe
Azure File Sync v18.0 5023058 (Security Update) Important Elevation of Privilege None Base: 4.4
Temporal: 4.2
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:R/S:U/C:N/I:H/A:N/E:H/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35253 3wyeye5 with OSR


Fangming Gu with OSR


chino71 with OSR

CVE-2024-35254 - Azure Monitor Agent Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35254
MITRE
NVD		 CVE Title: Azure Monitor Agent Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What actions do customers need to take to protect themselves from this vulnerability?

Customers who have disabled Automatic Extension Upgrades or would like to upgrade an extension immediately must manually update their Azure Monitor Agent to the latest version. For more information on how to perform a manual update, see Manage Azure Monitor Agent.


How could an attacker exploit this vulnerability and what privileges could an attacker gain?

An authenticated attacker with read access permissions can exploit this vulnerability to perform arbitrary file and folder deletion on the host where the Azure Monitor Agent is installed.


According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N) but have major impact on integrity (I:H) and on availability (A:H). What does that mean for this vulnerability?

This vulnerability does not allow disclosure of any confidential information, but could allow an attacker to delete data that could include data that results in the service being unavailable.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35254
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Azure Monitor Agent Release Notes (Security Update) Important Elevation of Privilege None Base: 7.1
Temporal: 6.2
Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:H/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35254 R4nger & Zhiniang Peng

CVE-2024-35263 - Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35263
MITRE
NVD		 CVE Title: Microsoft Dynamics 365 (On-Premises) Information Disclosure Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?

Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.


What type of information could be disclosed by this vulnerability?

This vulnerability allows exfiltration of all the data that the logged-in user can access.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Information Disclosure

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35263
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Dynamics 365 (on-premises) version 9.1 5039459 (Security Update) Important Information Disclosure None Base: 5.7
Temporal: 5.0
Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35263 Erik Donker

CVE-2024-35265 - Windows Perception Service Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-35265
MITRE
NVD		 CVE Title: Windows Perception Service Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could create or delete files in the security context of the “NT AUTHORITY\ LOCAL SERVICE” account.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to win a race condition.


According to the CVSS metric, privileges required is Low (PR:L). What does that mean for this vulnerability?

To exploit this vulnerability an attacker must have an account with the User role assigned.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-35265
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Windows 10 Version 1809 for 32-bit Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for ARM64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 1809 for x64-based Systems 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 21H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for 32-bit Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for ARM64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 10 Version 22H2 for x64-based Systems 5039211 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for ARM64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 version 21H2 for x64-based Systems 5039213 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 22H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for ARM64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows 11 Version 23H2 for x64-based Systems 5039212 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes
Windows Server 2019 (Server Core installation) 5039217 (Security Update) Important Elevation of Privilege None Base: 7.0
Temporal: 6.1
Vector: CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-35265 goodbyeselene

CVE-2024-37325 - Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-37325
MITRE
NVD		 CVE Title: Azure Science Virtual Machine (DSVM) Elevation of Privilege Vulnerability
Description:
Unknown
FAQ:

What actions do customers need to take to protect themselves from this vulnerability?

Only customers using Linux/Ubuntu Data Science Virtual Machines (DSVM) with versions prior to 24.05.24 may be affected. For guidance on how to update your resources, reference the following: Upgrade your Data Science Virtual Machine to Ubuntu 20.04. Customers who deploy DSVMs using CLI or scripts may also need to update the DSVM version specified in their deployment parameters.


How could an attacker exploit this vulnerability?

An unauthenticated attacker could send a specially crafted request to the target machine to gain access to credentials of authorized users. This could enable an attacker to impersonate the user and perform any operations the compromised user is permitted to perform.


What privileges could be gained by an attacker who successfully exploited the vulnerability?

An attacker who successfully exploited this vulnerability could gain the privileges of the compromised user.


According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Elevation of Privilege

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-37325
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Azure Data Science Virtual Machines for Linux Release Notes (Security Update) Important Elevation of Privilege None Base: 8.1
Temporal: 7.3
Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
 Yes

Acknowledgements

CVE ID Acknowledgements
CVE-2024-37325 Yanir Tsarimi

CVE-2024-30052 - Visual Studio Remote Code Execution Vulnerability

(top)
CVE ID Vulnerability Description Maximum Severity Rating Vulnerability Impact
CVE-2024-30052
MITRE
NVD		 CVE Title: Visual Studio Remote Code Execution Vulnerability
Description:
Unknown
FAQ:

According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?

Successful exploitation of this vulnerability requires an attacker to gather information specific to the environment of the targeted component.


According to the CVSS metric, the attack vector is local (AV:L). Why does the CVE title indicate that this is a remote code execution?

The word Remote in the title refers to the location of the attacker. This type of exploit is sometimes referred to as Arbitrary Code Execution (ACE). The attack itself is carried out locally.

For example, when the score indicates that the Attack Vector is Local and User Interaction is Required, this could describe an exploit in which an attacker, through social engineering, convinces a victim to download and open a specially crafted file from a website which leads to a local attack on their computer.


Mitigations:
None
Workarounds:
None
Revision:
1.0    2024-06-11T07:00:00    

Information published.


 Important Remote Code Execution

Exploitability Index

The following table provides an exploitability assessment of each of the vulnerabilities addressed this month. The vulnerabilities are listed in order of bulletin ID then CVE ID. Only vulnerabilities that have a severity rating of Critical or Important in the bulletins are included.

Exploitability Assessment for Latest Software Release Exploitability Assessment for Older Software Release Denial of Service Exploitability Assessment Publicly Disclosed Exploited
Exploitation Less Likely Not Found N/A No No

Affected Software

The following tables list the affected software details for the vulnerability.

CVE-2024-30052
Product KB Article Severity Impact Supersedence CVSS Score Set Restart Required
Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) Release Notes (Security Update) Important Remote Code Execution None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) Release Notes (Security Update) Important Remote Code Execution None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.10 Release Notes (Security Update) Important Remote Code Execution None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.4 Release Notes (Security Update) Important Remote Code Execution None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.6 Release Notes (Security Update) Important Remote Code Execution None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Maybe
Microsoft Visual Studio 2022 version 17.8 Release Notes (Security Update) Important Remote Code Execution None Base: 4.7
Temporal: 4.1
Vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N/E:U/RL:O/RC:C
 Maybe

Acknowledgements

CVE ID Acknowledgements
CVE-2024-30052 goodbyeselene