Security News > 2024 > April > Microsoft squashes SmartScreen security bypass bug exploited in the wild

Microsoft squashes SmartScreen security bypass bug exploited in the wild
2024-04-10 00:15

Patch Tuesday Microsoft fixed 149 security flaws in its own products this week, and while Redmond acknowledged one of those vulnerabilities is being actively exploited, we've been told another hole is under attack, too.

Trend Micro's Zero Day Initiative says a separate vulnerability, spotted and reported by bug hunter Peter Girrus, was under attack in the wild before Microsoft issued a patch this week.

Let's start with the bug ZDI categorizes as being under exploit in the wild.

This one is a SmartScreen prompt security feature bypass vulnerability tracked as CVE-2024-29988, and it received an 8.8 out of 10 CVSS severity rating.

Assuming an attacker can fool someone into clicking on a malicious link or opening a malware-laden file, the bug allows them to bypass the SmartScreen security feature in Windows that's supposed to alert users to any untrusted websites or other threats.

There's a whopping 12 CVEs in Experience Manager, and the patches resolve "Important" flaws that could result in arbitrary code execution and security feature bypass.


News URL

https://go.theregister.com/feed/www.theregister.com/2024/04/10/april_patch_tuesday/

Related Vulnerability

DATE CVE VULNERABILITY TITLE RISK
2024-04-09 CVE-2024-29988 Unspecified vulnerability in Microsoft products
SmartScreen Prompt Security Feature Bypass Vulnerability
network
low complexity
microsoft
8.8

Related vendor

VENDOR LAST 12M #/PRODUCTS LOW MEDIUM HIGH CRITICAL TOTAL VULNS
Microsoft 701 813 4663 4393 3691 13560