CVE-2024-38197
Published: 13 August 2024
Summary
CVE-2024-38197 is a medium-severity User Interface (UI) Misrepresentation of Critical Information (CWE-451) vulnerability in Microsoft Teams. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 6.4% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Teams for iOS contains a spoofing vulnerability tracked as CVE-2024-38197. The flaw is associated with CWE-451 and carries a CVSS 3.1 base score of 6.5 reflecting network attack vector, low complexity, no required privileges or user interaction, and limited impacts to confidentiality and integrity.
An unauthenticated attacker can exploit the issue remotely to spoof content or identity within the application, resulting in partial disclosure or alteration of information presented to users. The EPSS score has remained flat at a peak of 0.1109 since disclosure with no material upward trajectory observed.
The official advisory published by Microsoft at https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38197 contains the authoritative guidance for affected builds and any available remediation steps. No public reports of active exploitation have been noted in the provided data.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2024-37165
Vulnerability details
Microsoft Teams for iOS Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.