PT-2024-4694 · Microsoft · Windows Text Services Framework+1

Published 2024-07-09 · Updated 2025-01-09 · CVE-2024-21417

Positive Technologies (AI Summary)

CVSS v3.1

8.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:C/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows Text Services Framework (affected versions not specified)

Description: The issue is related to an elevation-of-privilege vulnerability in the Windows Text Services Framework, which is caused by weaknesses in the authorization procedure. This vulnerability can be exploited by an attacker to gain elevated privileges on the system.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

LPE

Missing Authorization

Weakness Enumeration

CWE-862

Related Identifiers

BDU:2024-05213

CVE-2024-21417

Affected Products

Windows

Windows Text Services Framework

References · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-21417 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21417 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-05213 · Security Note
• https://osv.dev/vulnerability/CVE-2024-21417 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2024-21417 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2024-21417 · Vendor Advisory
• https://t.me/cvenotify/85634 · Telegram Post
• https://t.me/cvedetector/491 · Telegram Post
• https://twitter.com/windowsforum/status/1831823522206810349 · Twitter Post
• https://twitter.com/CVEnew/status/1810944936516407420 · Twitter Post
• https://t.me/cvenotify/106918 · Telegram Post
• https://twitter.com/ComputerPunks/status/1810721361029124487 · Twitter Post