Attacker Value
Moderate
(1 user assessed)
Exploitability
Moderate
(1 user assessed)
User Interaction
None
Privileges Required
None
Attack Vector
Network
5

CVE-2024-21413

Disclosure Date: February 13, 2024
Add MITRE ATT&CK tactics and techniques that apply to this CVE.
Execution
Techniques
Validation
Validated
Validated
Validated
Validated
Validated
Validated

Description

Microsoft Outlook Remote Code Execution Vulnerability

Add Assessment

1
Ratings
Technical Analysis

Vulnerable software:

About Outlook Version:
You have Microsoft Outlook Version 1.2024.313.100 (Production).
Client Version is 20240308003.16 

Description:

By sending a malicious (.docm) file, to the victim using the Outlook mail – app of 365, the attacker will wait for the victim to click on it by using and executing his malicious code after the victim opens this file. After this action, the attacker can get control of some parts of the Windows services, he can steal sensitive information, and make a bot machine from the victim’s PC. It depends on the victim’s privileges, and what the attacker wants to do with him, this exploit may destroy completely the victim’s machine!

Demo: YouTube
m0r3:m0r3
Git:GitHub

CVSS V3 Severity and Metrics
Base Score:
9.8 Critical
Impact Score:
5.9
Exploitability Score:
3.9
Vector:
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
Attack Vector (AV):
Network
Attack Complexity (AC):
Low
Privileges Required (PR):
None
User Interaction (UI):
None
Scope (S):
Unchanged
Confidentiality (C):
High
Integrity (I):
High
Availability (A):
High

General Information

Vendors

  • microsoft

Products

  • 365 apps -,
  • office 2016,
  • office 2019,
  • office long term servicing channel 2021

Additional Info

Technical Analysis