CVE-2024-30040
Published: 14 May 2024
Summary
CVE-2024-30040 is a high-severity Improper Input Validation (CWE-20) vulnerability in Microsoft Windows 10 1809. Its CVSS base score is 8.8 (High).
Operationally, ranked in the top 3.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-10 (Information Input Validation) and SI-3 (Malicious Code Protection).
Deeper analysis
CVE-2024-30040 is a security feature bypass vulnerability affecting the Windows MSHTML platform. It carries a CVSS 3.1 base score of 8.8 with the vector string AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and is associated with CWE-20.
An attacker can exploit the flaw over the network without authentication or special privileges, provided the victim performs a required user interaction such as visiting a crafted web page. Successful exploitation can result in a complete compromise of confidentiality, integrity, and availability on the affected system.
Microsoft has issued remediation guidance through its security update guide, and the vulnerability appears in CISA’s catalog of known exploited vulnerabilities.
The associated EPSS score stands at 0.2866 with no material change from its recorded peak, while listing in the CISA catalog confirms observed real-world exploitation activity.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-27980
Vulnerability details
Windows MSHTML Platform Security Feature Bypass Vulnerability
- CWE(s)
- KEV Date Added
- 14 May 2024
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly counters the CWE-20 improper input validation root cause that enables the MSHTML security feature bypass.
Blocks or detects malicious HTML/rendering payloads that exploit the MSHTML bypass over the network.
Enforces information flow rules that can restrict the unauthorized actions resulting from a successful MSHTML bypass.