EXPOSURES › CVE-2024-38217
CVE-2024-38217
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Windows MOTW protection mechanism failure allows attackers to bypass integrity controls in Microsoft Office, enabling limited exploitation of security features.
This vulnerability bypasses the Mark of the Web (MOTW) protection mechanism in Windows, compromising integrity controls in Microsoft Office applications like Protected View. For DIB organizations, this poses a risk to document integrity and potential lateral movement if attackers can bypass these controls to execute malicious content. Immediate patching and verification of MOTW enforcement are critical to maintain compliance with NIST 800-171 integrity requirements.
Shame score — A known vulnerability in a widely used security mechanism that allows bypassing integrity controls, though limited in scope and not directly linked to ransomware.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Windows Mark of the Web (MOTW) contains a protection mechanism failure vulnerability that allows an attacker to bypass MOTW-based defenses. This can result in a limited loss of integrity and availability of security features such as Protected View in Microsoft Office, which rely on MOTW tagging.
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |