CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-30370

Medium Severity
SVRS
30/100
CVSSv3
NA/10
EPSS
0.00242/1

CVE-2024-30370 is a WinRAR Mark-Of-The-Web (MOTW) Bypass Vulnerability allowing attackers to circumvent security measures. This vulnerability enables remote attackers to bypass the Mark-Of-The-Web protection on WinRAR installations. The vulnerability lies in the archive extraction functionality, where a malicious archive can create arbitrary files without the MOTW flag. Successfully exploiting this vulnerability allows an attacker to execute arbitrary code within the user's context, especially when combined with other vulnerabilities. Although the CVSS score is 0, indicating low base severity, the SOCRadar Vulnerability Risk Score (SVRS) of 30 suggests a moderate level of risk based on real-world threat intelligence. While not immediately critical (SVRS > 80), continuous monitoring is recommended, as the "In The Wild" tag indicates active exploitation.

TAGS
In The Wild
VECTOR STRING
PUBLICATION DATE2024-04-02
LAST MODIFIED2024-04-03
Eye Icon
SOCRadar
AI Insight

Description

CVE-2024-30370 is a vulnerability in RARLAB WinRAR that allows remote attackers to bypass the Mark-Of-The-Web protection mechanism. This vulnerability has a CVSS score of 4.3 and an SVRS of 30, indicating a moderate level of severity.

Key Insights

  • This vulnerability can be exploited by attackers to execute arbitrary code in the context of the current user.
  • The vulnerability is actively exploited in the wild, making it a high-priority threat.
  • The Cybersecurity and Infrastructure Security Agency (CISA) has warned of the vulnerability, calling for immediate and necessary measures.

Mitigation Strategies

  • Update to the latest version of RARLAB WinRAR.
  • Disable the Mark-Of-The-Web protection mechanism.
  • Use a web browser that supports Mark-Of-The-Web protection.
  • Be cautious when opening archives from untrusted sources.

Additional Information

If users have additional queries regarding this incident, they can use the 'Ask to Analyst' feature, contact SOCRadar directly, or open a support ticket for more information if necessary.

Indicators of Compromise

No IOCs found for this CVE

Exploits

No exploits found for this CVE

Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CREATE FREE ACCOUNT
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

CVE-2024-30370 | RARLabs WinRAR up to 6.23 protection mechanism
vuldb.com2025-04-09
CVE-2024-30370 | RARLabs WinRAR up to 6.23 protection mechanism | A vulnerability, which was classified as critical, was found in RARLabs WinRAR. Affected is an unknown function. The manipulation leads to protection mechanism failure. This vulnerability is traded as CVE-2024-30370. It is possible to launch the attack remotely. There is no exploit available. It is recommended to upgrade the affected component.
vuldb.com
rss
forum
news
CVE-2024-30370 | RARLabs WinRAR protection mechanism
vuldb.com2024-05-08
CVE-2024-30370 | RARLabs WinRAR protection mechanism | A vulnerability, which was classified as critical, was found in RARLabs WinRAR. Affected is an unknown function. The manipulation leads to protection mechanism failure. This vulnerability is traded as CVE-2024-30370. It is possible to launch the attack remotely. There is no exploit available.
cve-2024-30370
domains
urls
cves

Social Media

No tweets found for this CVE

Affected Software

No affected software found for this CVE

References

ReferenceLink
[email protected]https://www.rarlab.com/rarnew.htm#27.%20Busgs%20fixed
[email protected]https://www.zerodayinitiative.com/advisories/ZDI-24-357/

CWE Details

CWE IDCWE NameDescription
CWE-693Protection Mechanism FailureThe product does not use or incorrectly uses a protection mechanism that provides sufficient defense against directed attacks against the product.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence