CVE-2024-38112

7.5

HIGH CVSS 3.1

Microsoft Windows MSHTML Platform Spoofing Vulnerability - [Actively Exploited]

Description

Windows MSHTML Platform Spoofing Vulnerability

INFO

Published Date :

July 9, 2024, 5:15 p.m.

Last Modified :

Jan. 27, 2025, 9:35 p.m.

Remotely Exploit :

Yes !

Source :

[email protected]

CISA Notification

CISA KEV (Known Exploited Vulnerabilities)

For the benefit of the cybersecurity community and network defenders—and to help every organization better manage vulnerabilities and keep pace with threat activity—CISA maintains the authoritative source of vulnerabilities that have been exploited in the wild.

Due Date: Jul 30, 2024

Alert Date: Jul 09, 2024 | 414 days ago

Description :

Microsoft Windows MSHTML Platform contains a spoofing vulnerability that has a high impact to confidentiality, integrity, and availability.

Required Action :

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Notes :

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112; https://nvd.nist.gov/vuln/detail/CVE-2024-38112

Affected Products

The following products are affected by CVE-2024-38112 vulnerability. Even if cvefeed.io is aware of the exact versions of the products that are affected, the information is not represented in the table below.

ID	Vendor	Product
1	Microsoft	windows_server_2008
2	Microsoft	windows_server_2012
3	Microsoft	windows_server_2016
4	Microsoft	windows_server_2019
5	Microsoft	windows_10_1607
6	Microsoft	windows_10_1809
7	Microsoft	windows_10_21h2
8	Microsoft	windows_10_22h2
9	Microsoft	windows_server_2022
10	Microsoft	windows_11_21h2
11	Microsoft	windows_11_22h2
12	Microsoft	windows_10_1507
13	Microsoft	windows
14	Microsoft	windows_11_23h2
15	Microsoft	windows_server_2022_23h2
16	Microsoft	windows_server_23h2
17	Microsoft	windows_server_2012_r2
18	Microsoft	windows_server_2008_sp2

: Total Affected Vendor : 1 | Products : 18

CVSS Scores

The Common Vulnerability Scoring System is a standardized framework for assessing the severity of vulnerabilities in software and systems. We collect and displays CVSS scores from various sources for each CVE.

Score	Version	Severity	Vector	Exploitability Score	Impact Score	Source
	CVSS 3.1	HIGH				[email protected]

Solution

A vulnerability in Microsoft Windows MSHTML Platform could allow for spoofing.

Apply the latest available security updates for your version of Windows.
Reboot the system if prompted.

Public PoC/Exploit Available at Github

CVE-2024-38112 has a 4 public PoC/Exploit available at Github. Go to the Public Exploits tab to see the list.

References to Advisories, Solutions, and Tools

Here, you will find a curated list of external links that provide in-depth information, practical solutions, and valuable tools related to CVE-2024-38112.

URL	Resource
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112	Patch Vendor Advisory
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38112	Patch Vendor Advisory

CWE - Common Weakness Enumeration

While CVE identifies specific instances of vulnerabilities, CWE categorizes the common flaws or weaknesses that can lead to vulnerabilities. CVE-2024-38112 is associated with the following CWEs:

CWE-451: User Interface (UI) Misrepresentation of Critical Information

Common Attack Pattern Enumeration and Classification (CAPEC)

Common Attack Pattern Enumeration and Classification (CAPEC) stores attack patterns, which are descriptions of the common attributes and approaches employed by adversaries to exploit the CVE-2024-38112 weaknesses.

CAPEC-98: Phishing Phishing CAPEC-154: Resource Location Spoofing Resource Location Spoofing CAPEC-163: Spear Phishing Spear Phishing CAPEC-164: Mobile Phishing Mobile Phishing CAPEC-173: Action Spoofing Action Spoofing

We scan GitHub repositories to detect new proof-of-concept exploits. Following list is a collection of public exploits and proof-of-concepts, which have been published on GitHub (sorted by the most recently updated).

BunBunCodes/CPSC253_CybersecurityFinalProjectReports

Report written on CVE-2024-38112

Updated: 1 month ago

0 stars 0 fork 0 watcher

Born at : July 25, 2025, 11:14 p.m. This repo has been linked 1 different CVEs too.

tylzars/awesome-vrre-writeups

A collection of Vulnerability Research and Reverse Engineering writeups.

Updated: 4 months, 2 weeks ago

1 stars 0 fork 0 watcher

Born at : Dec. 21, 2024, 2:55 p.m. This repo has been linked 49 different CVEs too.

hogehuga/threatWatchDog

None

Shell

Updated: 4 months, 3 weeks ago

3 stars 0 fork 0 watcher

Born at : Aug. 16, 2024, 6:28 a.m. This repo has been linked 1 different CVEs too.

thepcn3rd/goAdventures

None

Go Python Jupyter Notebook Shell PowerShell C# HTML Dockerfile

Updated: 4 weeks ago

1 stars 0 fork 0 watcher

Born at : June 9, 2023, 5:41 a.m. This repo has been linked 1 different CVEs too.

Results are limited to the first 15 repositories due to potential performance issues.

The following list is the news that have been mention CVE-2024-38112 vulnerability anywhere in the article.

TheCyberThrone

Microsoft Patch Tuesday Year 2024 Analysis

In 2024, Microsoft’s Patch Tuesday updates played a critical role in addressing security vulnerabilities across various platforms. Throughout the year, a total of 1,000+ vulnerabilities were patched, ...

Published Date: Dec 25, 2024 (8 months ago)

TheCyberThrone

Most Exploited Vulnerabilities in 2024 Top 20 Analysis

In 2024, the cybersecurity landscape saw a significant number of exploited vulnerabilities, highlighting the ongoing challenges organizations face in protecting their systems and data.Some key trends ...

Published Date: Dec 22, 2024 (8 months ago)

Kaspersky

Exploits and vulnerabilities in Q3 2024

Q3 2024 saw multiple vulnerabilities discovered in Windows and Linux subsystems that are not standard for cyberattacks. This is because operating system developers have been releasing new security mit ...

Published Date: Dec 06, 2024 (8 months, 3 weeks ago)

Cybersecurity News

Operation “Code on Toast”: A Deep Dive into TA-RedAnt’s Exploitation of Zero-Day Flaw (CVE-2024-38178)

JavaScript execution process in the Chakra engine | Image: NCSCNorth Korean-linked hacking group TA-RedAnt has been implicated in a sophisticated large-scale cyber attack dubbed “Operation Code on Toa ...

Published Date: Dec 02, 2024 (8 months, 3 weeks ago)

The Cyber Express

Microsoft Patches 117 CVEs: Focus on Critical and Zero-Day Threats

Microsoft has released the October 2024 Patch Tuesday, addressing a total of 117 Common Vulnerabilities and Exposures (CVEs). This month’s Microsoft Patch Tuesday update includes three vulnerabilities ...

Published Date: Oct 09, 2024 (10 months, 2 weeks ago)

The Hacker News

Microsoft Issues Security Update Fixing 118 Flaws, Two Actively Exploited in the Wild

Microsoft has released security updates to fix a total of 118 vulnerabilities across its software portfolio, two of which have come under active exploitation in the wild. Of the 118 flaws, three are r ...

Published Date: Oct 09, 2024 (10 months, 2 weeks ago)

TheCyberThrone

Microsoft Patch Tuesday – October 2024

Microsoft patched 117 CVEs in October 2024 Patch Tuesday release, with three rated critical, 113 rated important and one rated moderate.27 Elevation of Privilege vulnerabilities7 Security Feature Bypa ...

Published Date: Oct 09, 2024 (10 months, 2 weeks ago)

Dark Reading

5 CVEs in Microsoft's October Update to Patch Immediately

Source: fadfebrian via ShutterstockMicrosoft's October security update addressed a substantial 117 vulnerabilities, including two actively exploited flaws and three publicly disclosed but as yet unexp ...

Published Date: Oct 08, 2024 (10 months, 2 weeks ago)

Help Net Security

Microsoft patches two zero-days exploited in the wild (CVE-2024-43573, CVE-2024-43572)

For October 2024 Patch Tuesday, Microsoft has released fixes for 117 security vulnerabilities, including two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Plat ...

Published Date: Oct 08, 2024 (10 months, 2 weeks ago)

Help Net Security

Week in review: Critical VMware vCenter Server bugs fixed, Apple releases iOS 18

Here’s an overview of some of last week’s most interesting news, articles, interviews and videos: Critical VMware vCenter Server bugs fixed (CVE-2024-38812) Broadcom has released fixes for two vulnera ...

Published Date: Sep 22, 2024 (11 months ago)

TheCyberThrone

CISA KEV Update September 2024 -Part V

The US CISA adds two vulnerabilities to its Known Exploited Vulnerabilities Catalog based on the evidence of active exploitationThe first vulnerability tracked as CVE-2024-43461, Microsoft Windows MSH ...

Published Date: Sep 17, 2024 (11 months, 1 week ago)

Cybersecurity News

CISA Flags Two Actively Exploited Vulnerabilities: Critical Threats to Windows and WhatsUp Gold

The U.S. Cybersecurity and Infrastructure Security Agency (CISA) has issued a warning, adding two actively exploited security flaws to its Known Exploited Vulnerabilities (KEV) catalog, urging immedia ...

Published Date: Sep 17, 2024 (11 months, 1 week ago)

The Register

Microsoft confirms IE bug squashed in Patch Tuesday was exploited zero-day

Analysis Microsoft, in a low-key update to its September Patch Tuesday disclosures, has confirmed a just-fixed Internet Explorer vulnerability was exploited as a zero-day before it could be patched. R ...

Published Date: Sep 17, 2024 (11 months, 1 week ago)

Dark Reading

'Void Banshee' Exploits Second Microsoft Zero-Day

Source: Anucha Cheechang via ShutterstockMicrosoft has recategorized a bug that the company fixed in this month's Patch Tuesday update as a zero-day vulnerability, which the "Void Banshee" advanced pe ...