CVE-2024-21413

🗓️ 13 Feb 2024 18:02:24Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 23 Media mentions👁 1101 Views🌐 WEB

Microsoft Outlook Remote Code Execution Vulnerabilit

Reporter	Title	Published	Views	Family All 61
GithubExploit	Exploit for Improper Input Validation in Microsoft	6 Nov 202516:42	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	25 Jan 202616:34	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	10 Feb 202520:19	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	10 Feb 202622:06	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	29 Feb 202410:07	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	20 Nov 202503:47	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	23 Feb 202412:13	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	4 Jul 202601:16	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	30 May 202511:57	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	15 Feb 202419:57	–	githubexploit

NVD

Vulners

CNA

Node

microsoft 365_appsMatch-enterprise

microsoft office_2016Match--x64

microsoft office_2016Match--x86

microsoft office_2019Match-x64

microsoft office_2019Match-x86

microsoft office_long_term_servicing_channelMatch2021

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2019",
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "19.0.0",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft 365 Apps for Enterprise",
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.1",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office LTSC 2021",
    "platforms": [
      "x64-based Systems",
      "32-bit Systems"
    ],
    "versions": [
      {
        "version": "16.0.1",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2016",
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5435.1001",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413
vicarius	www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script
research	www.research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
vicarius	www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script

Parameter	Position	Path	Description	CWE
per_page	query param	/wp-json/wp/v2/users?per_page=100	Unauthenticated access to wp/v2/users exposes private keys and tokens for users (CVE-2025-9209)	CWE-200
Authorization	header	/wp-json/rp/v1/customers	Access RestroPress customers endpoint using stolen API keys/tokens to perform actions	CWE-200
X-API-Key	header	/wp-json/rp/v1/customers	Access RestroPress customers endpoint using stolen API keys/tokens to perform actions	CWE-200
X-User-ID	header	/wp-json/rp/v1/customers	Access RestroPress customers endpoint using stolen API keys/tokens to perform actions	CWE-200
Authorization	header	/wp-json/rp/v1/orders	Access RestroPress orders endpoint using stolen API keys/tokens to perform actions	CWE-200
X-API-Key	header	/wp-json/rp/v1/orders	Access RestroPress orders endpoint using stolen API keys/tokens to perform actions	CWE-200
X-User-ID	header	/wp-json/rp/v1/orders	Access RestroPress orders endpoint using stolen API keys/tokens to perform actions	CWE-200

17 Jun 2026 07:09Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.9466

SSVC