CVE-2023-24890
Microsoft Onedrive 1.0.0 – 14.2.2
Raw vector
CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:NCVSS and EPSS are reproduced from their sources (NVD, FIRST EPSS). Risk Priority is our own derived reading, not an NVD score.
Summary
CVE-2023-24890 is a medium-severity Weak Authentication (CWE-1390) vulnerability in Microsoft Onedrive. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 32% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
OWASP Top 10 for Web (2025)
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-28880
Vulnerability Data
Microsoft OneDrive for iOS Security Feature Bypass Vulnerability
- CWE(s)
Related Threats
CVEs Like This One
Affected Assets
Mitigating Controls
Likely Mitigating Controls AI
Per-CVE control mapping for this CVE has not run yet; the list below is derived from the weakness types (CWEs) cited in the NVD entry.
Helps detect exploitation of weak authentication mechanisms by notifying of previous unauthorized logons.
The IA policy requires strong authentication methods, reducing use of weak authentication.
Enforces dynamic, context-aware authentication that mitigates weak static authentication by increasing requirements based on risk or conditions.
Enforces authentication for users, reducing the viability of weak authentication mechanisms.
Requires authentication mechanisms to meet applicable standards and guidelines, preventing weak authentication.
Mitigating Controls (ISO/IEC 27001:2022 Annex A) AI
Derived directly from the weakness types (CWEs) cited in the NVD entry via our AI-authored CWE→ISO cross-walk (authority under review) — links open the control.
A.5.17 directly mandates non-guessable unique secrets, identity verification before issuance, secure transmission, immediate default changes, strong password enforcement, no reuse, and protected storage/transmission, which stops exploitation of most insufficient-proof cases in CWE-1390; the bounded remainder is non-password mechanisms (e.g. biometrics, certificates) or flawed protocol-level proof not covered by these password-centric rules.
A.8.5 directly mandates choosing sufficiently strong authentication techniques (including MFA, biometrics with fallback, brute-force protection, secure log-on procedures) that prove claimed identity, which stops exploitation of insufficient proof for most but not all cases in CWE-1390 (e.g. residual protocol-level or implementation-specific flaws remain possible).
Hardening callouts derived
DISA STIG baselines are authored against specific weaknesses. Where this CVE cites a broad weakness class, the mapping is not asserted at that abstraction (owner ruling, 2026-09-25: grade only at Base and below), so no rule is shown here rather than a rule shown against the wrong grain.