CVE-2024-38189 | Attaxion

CISA Known Exploited Vulnerability (KEV)

Name

Microsoft Project Remote Code Execution Vulnerability

Exploit added

August 13, 2024

Action due

September 3, 2024

Action required

Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.

Microsoft Project Remote Code Execution Vulnerability

CWE-ID	CWE Name
CWE-20	Improper Input Validation

cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021::::::x86:
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021::::::x64:
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::-::
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::macos::
cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:::::::*
cpe:2.3:a:microsoft:office:2019:::::-:x86:*
cpe:2.3:a:microsoft:office:2019:::::-:x64:*
cpe:2.3:a:microsoft:project_2016:-::::::x86:
cpe:2.3:a:microsoft:project_2016:-::::::x64:
cpe:2.3:a:microsoft:365_apps:-::::enterprise::x86:*
cpe:2.3:a:microsoft:365_apps:-::::enterprise::x64:*
cpe:2.3:a:microsoft:365_apps:-::::enterprise:::
cpe:2.3:a:microsoft:office:2019:::::macos::
cpe:2.3:a:microsoft:office:2019:::::-::
cpe:2.3:a:microsoft:office:2019::::click-to-run::x64:*
cpe:2.3:a:microsoft:office:2019::::click-to-run::x86:*
cpe:2.3:a:microsoft:office:2019::mac_os:::::
cpe:2.3:a:microsoft:office:2019::::::x64:
cpe:2.3:a:microsoft:office:2019::::::x86:
cpe:2.3:a:microsoft:office:2019:::::::*

Source:
NVD

Published:
August 13, 2024

Updated:
August 16, 2024

Base score:
8.8

Severity:

HIGH

Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Not defined