CVE-2024-21413

🗓️ 13 Feb 2024 18:02:24Reported by microsoftType

cve🔗 web.nvd.nist.gov📰️ 23 Media mentions👁 1142 Views🌐 WEB

Microsoft Outlook Remote Code Execution Vulnerabilit

Reporter	Title	Published	Views	Family All 62
GithubExploit	Exploit for Improper Input Validation in Microsoft	6 Nov 202516:42	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	25 Jan 202616:34	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	10 Feb 202520:19	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	10 Feb 202622:06	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	29 Feb 202410:07	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	20 Nov 202503:47	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	23 Feb 202412:13	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	5 Aug 202604:26	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	4 Jul 202601:16	–	githubexploit
GithubExploit	Exploit for Improper Input Validation in Microsoft	30 May 202511:57	–	githubexploit

NVD

Vulners

CNA

Node

microsoft 365_appsMatch-enterprise

microsoft office_2016Match--x64

microsoft office_2016Match--x86

microsoft office_2019Match-x64

microsoft office_2019Match-x86

microsoft office_long_term_servicing_channelMatch2021

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft 365 Apps for Enterprise",
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.1",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2016",
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "16.0.5435.1001",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2019",
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "19.0.0",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office LTSC 2021",
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.1",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]

Source	Link
msrc	www.msrc.microsoft.com/update-guide/vulnerability/CVE-2024-21413
research	www.research.checkpoint.com/2024/the-risks-of-the-monikerlink-bug-in-microsoft-outlook-and-the-big-picture/
vicarius	www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-detection-script
cisa	www.cisa.gov/known-exploited-vulnerabilities-catalog
vicarius	www.vicarius.io/vsociety/posts/cve-2024-21413-critical-monikerlink-vulnerability-affecting-microsoft-outlook-mitigation-script

Parameter	Position	Path	Description	CWE
per_page	query param	wp-json/wp/v2/users?per_page=100	Unauthenticated exposure of private API keys, public keys, and JWT tokens via the public users endpoint.	CWE-200
Authorization	header	wp-json/rp/v1/customers	Authenticated access to RestroPress resources using stolen tokens/keys after obtainingCredentials from the users endpoint.	CWE-200
X-API-Key	header	wp-json/rp/v1/customers	Authenticated access to RestroPress resources using stolen tokens/keys after obtainingCredentials from the users endpoint.	CWE-200
X-User-ID	header	wp-json/rp/v1/customers	Authenticated access to RestroPress resources using stolen tokens/keys after obtainingCredentials from the users endpoint.	CWE-200
Authorization	header	wp-json/rp/v1/orders	Authenticated access to RestroPress orders via stolen credentials.	CWE-200
X-API-Key	header	wp-json/rp/v1/orders	Authenticated access to RestroPress orders via stolen credentials.	CWE-200
X-User-ID	header	wp-json/rp/v1/orders	Authenticated access to RestroPress orders via stolen credentials.	CWE-200

10 Aug 2026 17:52Current

9.6High risk

Vulners AI Score9.6

CVSS 3.19.8

EPSS0.9466

SSVC