Cyber Resilience

CVE-2023-24865

Medium

Published: 14 March 2023

Published
14 March 2023
Modified
21 November 2024
KEV Added
Patch
CVSS Score v3.1 6.5 CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N
EPSS Score 0.1832 95.4th percentile
Risk Priority 24 60% EPSS · 20% KEV · 20% CVSS

Summary

CVE-2023-24865 is a medium-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Windows Server 2012. Its CVSS base score is 6.5 (Medium).

Operationally, ranked in the top 4.6% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.

Deeper analysis

CVE-2023-24865 is an information disclosure vulnerability affecting the Microsoft PostScript and PCL6 Class Printer Driver. It carries a CVSS 3.1 base score of 6.5 and is associated with CWE-20.

An attacker with low privileges can exploit the flaw over a network without user interaction to obtain sensitive information from the affected driver component. The attack requires no special conditions beyond network reachability and valid low-privileged credentials.

Microsoft has published mitigation guidance in its Security Response Center advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-24865. The EPSS score has remained flat at a peak of 0.1832 with no material increase after disclosure.

EU & UK References

Vulnerability details

Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability

CWE(s)

Related Threats

No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.

Affected Assets

microsoft
windows 10 1507
≤ 10.0.10240.19805
microsoft
windows 10 1607
≤ 10.0.14393.5786
microsoft
windows 10 1809
≤ 10.0.17763.4131
microsoft
windows 10 20h2
≤ 10.0.19042.2728
microsoft
windows 10 21h2
≤ 10.0.19044.2728
microsoft
windows 10 22h2
≤ 10.0.19045.2728
microsoft
windows 11 21h2
≤ 10.0.22000.1696
microsoft
windows 11 22h2
≤ 10.0.22000.1413
microsoft
windows server 2012
all versions, r2
microsoft
windows server 2016
all versions
+2 more product configuration(s) — see NVD for full list

Mitigating Controls

Likely Mitigating Controls AI

Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.

addresses: CWE-20

Security testing and developer training directly verify and enforce proper input validation, reducing exploitability of injection and malformed-data weaknesses.

addresses: CWE-20

Security testing and evaluation at multiple SDLC stages directly detects missing or flawed input validation, with the required remediation process ensuring fixes are applied.

addresses: CWE-20

Directly implements checks on information inputs to reject invalid data before processing.

addresses: CWE-20

Spam protection mechanisms perform filtering and detection on inbound/outbound messages, directly compensating for missing or weak input validation of unsolicited content.

References