PT-2024-2843 · Microsoft · Outlook For Windows

Michael Pizzicaroli · Published 2024-04-09 · Updated 2025-01-08 · CVE-2024-20670

Positive Technologies (AI Summary)

CVSS v2.0

9.4

High

Base vector

AV:N/AC:L/Au:N/C:C/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook for Windows (affected versions not specified)

Description The issue is related to insufficient input validation in Microsoft Outlook for Windows, allowing a remote attacker to perform spoofing attacks by sending a specially crafted email.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2024-02991

CVE-2024-20670

Affected Products

Outlook For Windows

References · 14

• https://nvd.nist.gov/vuln/detail/CVE-2024-20670 · Security Note
• https://bdu.fstec.ru/vul/2024-02991 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-20670 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2024-20670 · Vendor Advisory
• https://twitter.com/_r_netsec/status/1780502229335859690 · Twitter Post
• https://twitter.com/CVEnew/status/1777750289921302922 · Twitter Post
• https://t.me/rnetsec/20240 · Telegram Post
• https://t.me/defcon_news/122926 · Telegram Post
• https://t.me/avleonovcom/1318 · Telegram Post
• https://t.me/cvenotify/76201 · Telegram Post
• https://twitter.com/fletch_ai/status/1778181219408355410 · Twitter Post
• https://twitter.com/cracbot/status/1777930918071611741 · Twitter Post
• https://twitter.com/fletch_ai/status/1786123572983054512 · Twitter Post
• https://twitter.com/ennakaorix/status/1779515469055090883 · Twitter Post