{"id":"CVE-2024-38217","kind":"vulnerability","aliases":["CVE-2024-38217"],"related":[],"title":"Windows Mark of the Web Security Feature Bypass Vulnerability","description":"Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.\n\nCISA required action: Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","summary":"Windows fails to apply the Mark of the Web tag to certain files, so Windows security warnings and Office Protected View may not trigger on them. An attacker who gets a crafted file to a user can bypass those defenses and gain limited loss of integrity and availability.","severity":"medium","cvss":5.4,"epss":null,"exploited":true,"exploited_at":"2024-09-10T00:00:00+00:00","products":[{"name":"Microsoft Windows","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows 10 1507","fixed":["10.0.10240.20766"],"affected":"< 10.0.10240.20766","ecosystem":"vendor"},{"name":"microsoft windows 10 1607","fixed":["10.0.14393.7336"],"affected":"< 10.0.14393.7336","ecosystem":"vendor"},{"name":"microsoft windows 10 1809","fixed":["10.0.17763.6293"],"affected":"< 10.0.17763.6293","ecosystem":"vendor"},{"name":"microsoft windows 10 21h2","fixed":["10.0.19044.4894"],"affected":"< 10.0.19044.4894","ecosystem":"vendor"},{"name":"microsoft windows 10 22h2","fixed":["10.0.19045.4894"],"affected":"< 10.0.19045.4894","ecosystem":"vendor"},{"name":"microsoft windows 11 21h2","fixed":["10.0.22000.3197"],"affected":"< 10.0.22000.3197","ecosystem":"vendor"},{"name":"microsoft windows 11 22h2","fixed":["10.0.22621.4169"],"affected":"< 10.0.22621.4169","ecosystem":"vendor"},{"name":"microsoft windows 11 23h2","fixed":["10.0.22631.4169"],"affected":"< 10.0.22631.4169","ecosystem":"vendor"},{"name":"microsoft windows 11 24h2","fixed":["10.0.26100.1742"],"affected":"< 10.0.26100.1742","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2008","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"","ecosystem":"vendor"},{"name":"microsoft windows server 2012","fixed":[],"affected":"= r2","ecosystem":"vendor"},{"name":"microsoft windows server 2016","fixed":["10.0.14393.7336"],"affected":"< 10.0.14393.7336","ecosystem":"vendor"},{"name":"microsoft windows server 2019","fixed":["10.0.17763.6293"],"affected":"< 10.0.17763.6293","ecosystem":"vendor"},{"name":"microsoft windows server 2022","fixed":["10.0.20348.2700"],"affected":"< 10.0.20348.2700","ecosystem":"vendor"},{"name":"microsoft windows server 2022 23h2","fixed":["10.0.25398.1128"],"affected":"< 10.0.25398.1128","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","microsoft-office","windows"],"not_affected_if":["unknown"],"how_to_check":null,"fix":"Apply Microsoft's July 2024 Windows security update per vendor instructions, or follow the mitigations Microsoft lists for this CVE. Discontinue use of the product if no mitigation is available, per CISA.","status":"open","published_at":"2024-09-10T00:00:00+00:00","first_seen_at":"2026-10-23T19:11:51+00:00","triaged_at":"2026-10-23T20:58:10+00:00","updated_at":"2026-10-23T22:29:05+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T20:58:10Z","model":"claude-haiku-5-5","output":{"fix":"Apply Microsoft's July 2024 Windows security update per vendor instructions, or follow the mitigations Microsoft lists for this CVE. Discontinue use of the product if no mitigation is available, per CISA.","reach":"unknown","impact":"medium","summary":"Windows fails to apply the Mark of the Web tag to certain files, so Windows security warnings and Office Protected View may not trigger on them. An attacker who gets a crafted file to a user can bypass those defenses and gain limited loss of integrity and availability.","category":"infrastructure","who_cares":["windows","microsoft-office"],"confidence":0.6,"needs_auth":"no","worst_case":"Malicious files bypass Protected View and MOTW warnings, enabling limited integrity and availability loss.","analyst_note":"Confirm the patched Windows build numbers and Microsoft's exact mitigation steps at the Microsoft Security Update Guide entry for CVE-2024-38217.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["unknown"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"medium"},"cost_usd":0.000491,"input_tokens":2879,"output_tokens":406,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-2024':11A,14A '-38217':12A,15A '10':20A,24A,28A,32A,36A '11':40A,44A,48A,52A '1507':21A '1607':25A '1809':29A '2008':57A,61A '2012':65A,69A '2016':73A '2019':77A '2022':81A,85A '21h2':33A,41A '22h2':37A,45A '23h2':49A,86A '24h2':53A 'action':192C 'allow':155C 'appli':96B,193C 'attack':120B,157C 'avail':140B,174C 'base':162C 'bypass':8A,130B,159C 'certain':104B 'cisa':190C 'contain':148C 'craft':124B 'cve':10A,13A 'defens':132B,163C 'discontinu':199C 'exploit':87B 'fail':94B 'failur':152C 'featur':7A,177C 'file':105B,125B 'gain':134B 'get':122B 'infrastructur':88B 'instruct':197C 'integr':138B,172C 'limit':135B,169C 'loss':136B,170C 'mark':2A,98B,143C 'may':114B 'mechan':151C 'microsoft':16A,18A,22A,26A,30A,34A,38A,42A,46A,50A,54A,58A,62A,66A,70A,74A,78A,82A,90B,141C,183C 'microsoft-offic':89B 'mitig':194C,205C 'motw':147C,161C,188C 'motw-bas':160C 'offic':91B,111B,184C 'per':195C 'product':203C 'protect':112B,150C,180C 'reli':186C 'requir':191C 'result':166C 'secur':6A,108B,176C 'server':56A,60A,64A,68A,72A,76A,80A,84A 'tag':102B,189C 'trigger':116B 'unavail':207C 'use':200C 'user':128B 'vendor':196C 'view':113B,181C 'vulner':9A,153C 'warn':109B 'web':5A,101B,146C 'window':1A,92B,93B,107B,142C 'windows':17A,19A,23A,27A,31A,35A,39A,43A,47A,51A,55A,59A,63A,67A,71A,75A,79A,83A","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2024-09-10T00:00:00+00:00","kev":{"dateAdded":"2024-09-10","dueDate":"2024-10-01","requiredAction":"Apply mitigations per vendor instructions or discontinue use of the product if mitigations are unavailable.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:L","cvss_by":"secure@microsoft.com","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2024-38217","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2024-38217","severity":null,"published_at":"2024-09-10T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:51+00:00","fetched_at":"2026-10-25T16:39:46+00:00","note":null},{"source":"nvd","external_id":"CVE-2024-38217","url":"https://nvd.nist.gov/vuln/detail/CVE-2024-38217","severity":null,"published_at":"2024-09-10T17:15:24+00:00","modified_at":"2026-08-10T16:19:03+00:00","first_seen_at":"2026-10-23T22:29:05+00:00","fetched_at":"2026-10-23T22:29:05+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}