CVE-2024-38091

Deeper analysis

CVE-2024-38091 is a denial-of-service vulnerability in Microsoft WS-Discovery that carries a CVSS 3.1 score of 7.5. The flaw is remotely exploitable over the network with low attack complexity, no privileges, and no user interaction required, resulting in a high impact to availability while leaving confidentiality and integrity unaffected.

An unauthenticated attacker can send specially crafted WS-Discovery traffic to trigger the condition, rendering affected services unavailable. Because the vector is network-based and requires no authentication, the issue can be triggered from anywhere on the network path to an exposed endpoint.

Microsoft's advisory at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38091 supplies mitigation and patch information for supported products. The associated EPSS score rose from a low baseline to a peak of 0.1570, indicating that exploitation interest increased after public disclosure.