What is CVE-2023-29324?

CVE-2023-29324 is a medium-severity security feature bypass vulnerability in various Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server versions. This vulnerability allows an attacker to craft a malicious URL that evades security checks, resulting in a limited loss of integrity and availability on the victim's machine. Systems running affected Microsoft Windows operating systems, including 32-bit, x64-based, and ARM64-based systems, are vulnerable.

Who is impacted by this?

CVE-2023-29324 affects users of Microsoft Windows operating systems, including Windows 10, Windows 11, and Windows Server versions. This vulnerability allows attackers to bypass security features through a malicious URL, leading to a limited loss of integrity and availability on the affected systems. Users of these Windows versions should be aware of this vulnerability and its potential impact.

What to do if CVE-2023-29324 affected you

If you're affected by the CVE-2023-29324 vulnerability, it's important to take action to protect your system. Follow these simple steps:

1. Install the updates for CVE-2023-23397 and CVE-2023-29324.

2. If you use Security Only updates, install the IE Cumulative updates for this vulnerability.

3. Download and install the appropriate security update for your Windows version from the Microsoft Update Catalog.

Is this in CISA’s Known Exploited Vulnerabilities Catalog?

The CVE-2023-29324 vulnerability, also known as Windows MSHTML Platform Security Feature Bypass Vulnerability, is not listed in CISA's Known Exploited Vulnerabilities Catalog. It was published on May 9, 2023, and the required action is to apply the patch provided by Microsoft. This vulnerability allows attackers to bypass security features, potentially causing a limited loss of integrity and availability on affected systems.

Weakness Enumeration

The weakness enumeration for this vulnerability is categorized as CWE-73, which involves external control of file name or path.

Learn More

For a comprehensive understanding of this vulnerability, including its description, severity, technical details, and known affected software configurations, visit the NVD page or refer to the sources below.

• Microsoft Security Update Guide

• CVE Record