PT-2024-9305 · Microsoft · Edge

Haifei Li + 2 · Published 2024-12-05 · Updated 2025-01-08 · CVE-2024-49041

Positive Technologies (AI Summary)

CVSS v2.0

5.0

Medium

Base vector

AV:N/AC:L/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Edge (Chromium-based) versions up to 131.0.2903.63

Description: A spoofing vulnerability exists in Microsoft Edge, which is based on Chromium. The vulnerability may allow a remote attacker to conduct spoofing attacks by exploiting errors in the user interface's representation of information. The issue can cause the UI to perform wrong actions.

Recommendations: For versions up to 131.0.2903.63, upgrade the affected component immediately to resolve the issue. At the moment, there is no information about additional mitigation measures for this vulnerability.

Fix

Weakness Enumeration

CWE-449

Related Identifiers

BDU:2024-10994

CVE-2024-49041

ZDI-24-1658

Affected Products

Edge

References · 16

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-49041 · Vendor Advisory
• https://bdu.fstec.ru/vul/2024-10994 · Security Note
• https://zerodayinitiative.com/advisories/ZDI-24-1658 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-49041 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2024-49041 · Security Note
• https://osv.dev/vulnerability/CVE-2024-49041 · Vendor Advisory
• https://twitter.com/vuldb/status/1864879205642879401 · Twitter Post
• https://twitter.com/gothburz/status/1866555373408358812 · Twitter Post
• https://t.me/cvenotify/103253 · Telegram Post
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2024-49041 · Note
• https://t.me/cvenotify/106758 · Telegram Post
• https://t.me/cvedetector/12163 · Telegram Post
• https://twitter.com/CVEnew/status/1864863176405463347 · Twitter Post
• https://twitter.com/oktsec/status/1864891927616778665 · Twitter Post
• https://twitter.com/VulmonFeeds/status/1864970451497185708 · Twitter Post