vulnerability
Microsoft Windows: CVE-2024-38517: Github: CVE-2024-38517 TenCent RapidJSON Elevation of Privilege Vulnerability
| Severity | CVSS | Published | Added | Modified |
|---|---|---|---|---|
| 7 | (AV:L/AC:M/Au:N/C:C/I:C/A:C) | 07/09/2024 | 07/09/2024 | 08/13/2024 |
Severity
7
CVSS
(AV:L/AC:M/Au:N/C:C/I:C/A:C)
Published
07/09/2024
Added
07/09/2024
Modified
08/13/2024
Description
Tencent RapidJSON is vulnerable to privilege escalation due to an integer underflow in the `GenericReader::ParseNumber()` function of `include/rapidjson/reader.h` when parsing JSON text from a stream. An attacker needs to send the victim a crafted file which needs to be opened; this triggers the integer underflow vulnerability (when the file is parsed), leading to elevation of privilege.
Solution(s)
microsoft-windows-windows_10-1607-kb5040434microsoft-windows-windows_10-1809-kb5040430microsoft-windows-windows_10-21h2-kb5040427microsoft-windows-windows_10-22h2-kb5040427microsoft-windows-windows_11-21h2-kb5040431microsoft-windows-windows_11-22h2-kb5040442microsoft-windows-windows_11-23h2-kb5040442microsoft-windows-windows_server_2016-1607-kb5040434microsoft-windows-windows_server_2019-1809-kb5040430microsoft-windows-windows_server_2022-21h2-kb5040437microsoft-windows-windows_server_2022-22h2-kb5040437microsoft-windows-windows_server_2022-23h2-kb5040438
References
- CVE-2024-38517
- https://attackerkb.com/topics/CVE-2024-38517
- URL-https://support.microsoft.com/help/5040427
- URL-https://support.microsoft.com/help/5040430
- URL-https://support.microsoft.com/help/5040431
- URL-https://support.microsoft.com/help/5040434
- URL-https://support.microsoft.com/help/5040437
- URL-https://support.microsoft.com/help/5040438
- URL-https://support.microsoft.com/help/5040442
NEW
Explore Exposure Command
Confidently identify and prioritize exposures from endpoint to cloud with full attack surface visibility and threat-aware risk context.