CVE-2024-43461
Windows MSHTML Platform Spoofing Vulnerability
High
Known exploited
- Severity
- 8.8 / 10
- High · CVSS 3.1
- Exploit chance (EPSS)
- 54.49%
- Chance of exploitation in the next 30 days. Higher than 99.02% of scored vulnerabilities.
- Known exploited
- Yes
- In CISA's catalog since Sep 16, 2024
- Weakness
- CWE-451 User Interface (UI) Misrepresentation of Critical Information
- Fix
- None yet
- No fixed version published
Exploited in the wild. Microsoft Windows MSHTML Platform Spoofing Vulnerability (Microsoft Windows). Required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable. Due for U.S. federal agencies by Oct 7, 2024.
Description
Windows MSHTML Platform Spoofing Vulnerability
How to fix
No fixed version has been published yet. Until one is, remove or replace the package, or turn off or isolate the affected feature. This page updates when a fix ships.
Severity breakdown
CVSS 3.1 8.8
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
- Attack vector
- Network
- Attack complexity
- Low
- Privileges required
- None
- User interaction
- Required
- Scope
- Unchanged
- Confidentiality
- High
- Integrity
- High
- Availability
- High
Weakness
CWE-451: User Interface (UI) Misrepresentation of Critical Information
The user interface (UI) does not properly represent critical information to the user, allowing the information - or its source - to be obscured or spoofed. This is often a component in phishing attacks.
How to prevent it
- Implementation: Perform data validation (e.g. syntax, length, etc.) before interpreting the data.
- Architecture and Design: Create a strategy for presenting information, and plan for how to display unusual characters.
References
Advisories
Other links
Timeline
- Published
- Added to CISA's Known Exploited Vulnerabilities catalog
- Remediation due for U.S. federal agencies
- Last updated by the source
- Latest EPSS score
Related advisories
| Advisory | Severity | Why it's related |
|---|---|---|
| GHSA-q84f-53jg-9ppm better-auth: Device login approval does not show the requesting client or permissions | High | Same weakness, CWE-451 |
| GHSA-v3wm-qf9p-c549 Symfony: HtmlSanitizer URL Parser Deny Gates Underinclusive: Percent-Encoded BiDi Marks and Unicode Whitespace Bypass Visual-Spoofing Defense | Medium | Same weakness, CWE-451 |
| GHSA-xww8-gqvh-92x9 OpenClaw: Exec approval display truncation could hide the command being approved | High | Same weakness, CWE-451 |
| GHSA-h5vq-qfcg-4m6p Symfony's HtmlSanitizer URL Attributes Pass Through BiDi Override Characters → Visual href Spoofing | Medium | Same weakness, CWE-451 |
| GHSA-rw39-5899-8mxp OpenClaw: Node-host approvals could show misleading shell payloads instead of the executed argv | High | Same weakness, CWE-451 |
| GHSA-7q2j-c4q5-rm27 OpenClaw macOS deep link confirmation truncation can conceal executed agent message | Medium | Same weakness, CWE-451 |
| DRUPAL-CORE-2025-007 Drupal core allows Content Spoofing | Medium | Same weakness, CWE-451 |
| GHSA-m3r7-8gw7-qwvc thorsten/phpmyfaq Unintended File Download Triggered by Embedded Frames | High | Same weakness, CWE-451 |
MergeHarbor checks every repository's dependencies against this database, ranks what matters by exploitability and reachability, routes it to the owning team and opens the fix pull request.
Check your repos with MergeHarbor