CVE-2024-38091 : Microsoft WS-Discovery Denial of Service Vulnerability

Microsoft WS-Discovery Denial of Service Vulnerability

Published 2024-07-09 17:15:45

Updated 2024-07-12 15:35:41

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Denial of service

Products affected by CVE-2024-38091

Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X64
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x64:*
Matching versions
Microsoft » Windows Server 2008 » Version: N/A Update SP2 For X86
cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:x86:*
Matching versions
Microsoft » Windows Server 2008 » Version: R2 Update SP1 For X64
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*
Matching versions
Microsoft » Windows Server 2012 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2012 » Version: R2
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2016
Versions before (<) 10.0.14393.7159
cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2019
Versions before (<) 10.0.17763.6054
cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2022
Versions before (<) 10.0.20348.2582
cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 21h2
Versions before (<) 10.0.22000.3079
cpe:2.3:o:microsoft:windows_11_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 22h2
Versions before (<) 10.0.22621.3880
cpe:2.3:o:microsoft:windows_11_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1607
Versions before (<) 10.0.14393.7159
cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1809
Versions before (<) 10.0.17763.6054
cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 21h2
Versions before (<) 10.0.19044.4651
cpe:2.3:o:microsoft:windows_10_21h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 22h2
Versions before (<) 10.0.19045.4651
cpe:2.3:o:microsoft:windows_10_22h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 1507
Versions before (<) 10.0.10240.20710
cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 11 23h2
Versions before (<) 10.0.22631.3880
cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2022 23h2
Versions before (<) 10.0.25398.1009
cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2024-38091

EPSS FAQ

17.77%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 95 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2024-38091

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H	3.9	3.6	Microsoft Corporation	2024-07-09
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High
7.5	HIGH	CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:H/...	N/A	N/A	MS-CVE-2024-38091	2024-07-09
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: None Scope: Unchanged Confidentiality: None Integrity: None Availability: High

CWE ids for CVE-2024-38091

CWE-166 Improper Handling of Missing Special Element

The product receives input from an upstream component, but it does not handle or incorrectly handles when an expected special element is missing.

Assigned by: secure@microsoft.com (Secondary)

References for CVE-2024-38091

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38091

CVE-2024-38091 - Security Update Guide - Microsoft - Microsoft WS-Discovery Denial of Service Vulnerability
Patch;Vendor Advisory

Jump to

Vulnerability Details : CVE-2024-38091

Products affected by CVE-2024-38091

Exploit prediction scoring system (EPSS) score for CVE-2024-38091

CVSS scores for CVE-2024-38091

CWE ids for CVE-2024-38091

References for CVE-2024-38091