Microsoft has released multiple patches for vulnerabilities covering a range of their products. These monthly releases are called “Patch Tuesday” and contain security fixes for Microsoft devices and software.

The CCB would like to point your attention to following vulnerabilities:

CVE-2024-30051: Windows DWM Core Library (Actively exploited – Zero-day)

Elevation of Privilege Vulnerability. This vulnerability allows a local attacker already present on a vulnerable system to exploit it and granting them SYSTEM privileges and complete control over the device. With a CVSSv3 score of 7.8, it's rated important. Microsoft noted that it was exploited in the wild as a zero-day. Kaspersky researchers report its use alongside QakBot and other malware, suggesting multiple threat actors have access to it.

CVE-2024-30040: Windows MSHTML Platform (Actively exploited – Zero-day)

Security Feature Bypass Vulnerability. An attacker can exploit this vulnerability by using social engineering tactics via email, social media or instant messaging to convince a target user to open a specially crafted document. Once exploited, an attacker could execute code on the target system. The vulnerability is exploited in the wild and was assigned a CVSSv3 score of 8.8 rated as important.

CVE-2024-30046: Visual Studio

Denial of Service Vulnerability. CVE-2024-30046 is a denial of service (DoS) vulnerability affecting multiple versions of Microsoft Visual Studio 2022. It was assigned a CVSSv3 score of 5.9 and is rated important. According to Microsoft’s Exploitability Index it is rated as “Exploitation Less Likely” and the Attack Complexity is High.

CVE-2024-30043: Microsoft SharePoint Server

Information Disclosure Vulnerability. An authenticated attacker could use this bug to read local files with SharePoint Farm service account user privileges. The scope of file content which could be accessed is dependent on the privileges of compromised user. According to Microsoft’s it is rated as “Exploitation Less Likely” and was assigned a score of 6.5.

CVE-2024-30044: Microsoft SharePoint Server

Remote Code Execution Vulnerability. To exploit this CVE, an attacker needs to be authenticated to a vulnerable SharePoint Server with Site Owner permissions to perform two steps: 1.) the attacker must upload a specially crafted file to the vulnerable SharePoint Server and 2.) send specially crafted API requests to the SharePoint Server in order to “trigger deserialization of file’s parameters. This attack requires no user interaction. This vulnerability is rated as “Exploitation More Likely” according to Microsoft and was assigned a CVSSv3 score of 8.8 rated as critical.

CVE-2024-30033: Microsoft Search Service

Elevation of Privilege Vulnerability. An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment. This vulnerability is rated as “Exploitation Less Likely” according to Microsoft and was assigned a CVSSv3 score of 7.0.

CVE-2024-29996 and CVE-2024-30025: Common Log File System Driver

Elevation of Privilege Vulnerabilities. An attacker who successfully exploited these vulnerabilities could gain SYSTEM privileges. These vulnerability are rated as “Exploitation More Likely” according to Microsoft and were assigned a CVSSv3 score of 7.8.