KLA71455 SUI vulnerability in Microsoft Office

2024-08-0800:00:00

Kaspersky Lab

threats.kaspersky.com

microsoft office

sui vulnerability

spoofing

CVSS3

6.5

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

AI Score

6.9

Confidence

High

EPSS

0.003

Percentile

70.8%

JSON

Spoofing vulnerability was found in Microsoft Office. Malicious users can exploit this vulnerability to spoof user interface.

Original advisories

CVE-2024-38200

Related products

Microsoft-Office

CVE list

CVE-2024-38200 high

KB list

5002570

5002625

Solution

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update component usually can be accessed from the Control Panel) and updates from the Update Options section, that are listed in your Office Account (Office Account tab usually can be accessed from the File menu)

Install Office updates

Impacts

Spoof user interface. Exploitation of vulnerabilities with this impact can lead to changes in user interface to beguile user into inaccurate behavior.

Affected Products

Microsoft 365 Apps for Enterprise for 32-bit SystemsMicrosoft 365 Apps for Enterprise for 64-bit SystemsMicrosoft Office 2016 (64-bit edition)Microsoft Office 2016 (32-bit edition)Microsoft Office LTSC 2021 for 32-bit editionsMicrosoft Office LTSC 2021 for 64-bit editionsMicrosoft Office 2019 for 64-bit editionsMicrosoft Office 2019 for 32-bit editions