CVE-2024-41159
Severity Score
7.1
*CVSS v3.1
Exploit Likelihood
*EPSS
Affected Versions
*CPE
Public Exploits
0
*Multiple Sources
Exploited in Wild
-
*KEV
Decision
Track*
*SSVC
Descriptions
A library injection vulnerability exists in Microsoft OneNote 16.83 for macOS. A specially crafted library can leverage OneNote's access privileges, leading to a permission bypass. A malicious application could inject a library and start the program to trigger this vulnerability and then make use of the vulnerable application's permissions.
Existe una vulnerabilidad de inyección de librería en Microsoft OneNote 16.83 para macOS. Una librería especialmente manipulada puede aprovechar los privilegios de acceso de OneNote, lo que lleva a una omisión de permisos. Una aplicación malintencionada podría inyectar una librería e iniciar el programa para activar esta vulnerabilidad y luego hacer uso de los permisos de la aplicación vulnerable.
*Credits:
Discovered by Francesco Benvenuto of Cisco Talos.
CVSS Scores
Attack Vector
Attack Complexity
Privileges Required
User Interaction
Scope
Confidentiality
Integrity
Availability
Attack Vector
Attack Complexity
Authentication
Confidentiality
Integrity
Availability
* Common Vulnerability Scoring System
SSVC
- Decision:Track*
Exploitation
Automatable
Tech. Impact
* Organization's Worst-case Scenario
Timeline
- 2024-08-05 CVE Reserved
- 2024-12-18 CVE Published
- 2024-12-20 CVE Updated
- 2025-03-30 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-347: Improper Verification of Cryptographic Signature
CAPEC
References (2)
| URL | Tag | Source |
|---|---|---|
| https://talosintelligence.com/vulnerability_reports/TALOS-2024-1975 | ||
| https://www.talosintelligence.com/vulnerability_reports/TALOS-2024-1975 |
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|
| URL | Date | SRC |
|---|