Microsoft Outlook Remote Code Execution Vulnerability
Loading...
Loading...
Score 8.0 from GitHub Security Advisory (severity: HIGH) published 2024-02-13. NVD baseline CVSS 8.8; sources differ by 0.8.
Microsoft Outlook Remote Code Execution Vulnerability
February 13, 2024
November 21, 2024
MITRE Common Weakness Enumeration — the root-cause categories this CVE belongs to.
Every vendor that published an advisory referencing this CVE — pulled from our cve_vendor_advisories aggregation. Click any row for the vendor's original advisory page.
Every time one of our enrichment pipelines (NVD, MITRE cvelistV5, EPSS, CISA KEV, GHSA, OSV, vendor advisories) ran against this CVE. Most recent first.
Working exploit code is in the public domain (1 GitHub PoC). Defenders should treat patch urgency accordingly — public PoCs typically lead to mass-exploitation within 24-72 hours.
This repository contains an exploit for targeting Microsoft Outlook through Exchange Online, leveraging a vulnerability to execute arbitrary code via COM DLLs. The exploit utilizes a modified version of Ruler to send a malicious form as an email, triggering the execution upon user interaction within the Outlook thick client.
Open source ↗See which npm, PyPI, Go, and Maven packages are affected by CVE-2024-21378
EchelonGraph automatically scans your cloud infrastructure and maps CVE exposure using blast radius analysis.
msrc
CWE-94