CVE Radar Logo
CVERadar
CVE Radar Logo
CVERadar

CVE-2024-43573

Critical Severity
Microsoft
SVRS
72/100

CVSSv3
6.5/10

EPSS
0.11123/1

CVE-2024-43573 is a Windows MSHTML Platform Spoofing Vulnerability. This flaw allows attackers to potentially spoof content, leading to malicious activities if a user interacts with the crafted content. The CVSS score is 6.5, but with an SVRS of 72, it's approaching critical, indicating a heightened risk due to observed real-world exploitation and active threat actor interest. Although not a critical vulnerability according to SOCRadar's vulnerability scoring system, this should still be investigated due to it being actively exploited. The fact that it is present on the CISA KEV list further emphasizes the need for patching. Exploiting this vulnerability can result in compromised user systems. Mitigating this vulnerability promptly is critical to prevent potential attacks.

CISA KEV
In The Wild
Vendor-advisory
CVSS:3.1
AV:N
AC:L
PR:N
UI:R
S:U
C:H
I:N
A:N
E:F
RL:O
RC:C
2024-10-08

2025-01-29

Indicators of Compromise

No IOCs found for this CVE

Exploits

TitleSoftware LinkDate
Microsoft Windows MSHTML Platform Spoofing Vulnerabilityhttps://www.cisa.gov/search?g=CVE-2024-435732024-10-08
Enhance Your CVE Management with SOCRadar Vulnerability Intelligence
Get comprehensive CVE details, real-time notifications, and proactive threat management all in one platform.
CVE Details
Access comprehensive CVE information instantly
Real-time Tracking
Subscribe to CVEs and get instant updates
Exploit Analysis
Monitor related APT groups and threats
IOC Tracking
Analyze and track CVE-related IOCs

News

Funding Expires for Key Cyber Vulnerability Database
BrianKrebs2025-04-16
Funding Expires for Key Cyber Vulnerability Database | A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of breaking down. The federally funded, non-profit research and development organization MITRE warned today that its contract to maintain the Common Vulnerabilities and Exposures (CVE) program -- which is traditionally funded each year by the Department of Homeland Security -- expires on April 16.A critical resource that cybersecurity professionals worldwide rely on to identify, mitigate and fix security vulnerabilities in software and hardware is in danger of
krebsonsecurity.com
rss
forum
news
Microsoft’s March 2025 Patch Tuesday Addresses 56 CVEs (CVE-2025-26633, CVE-2025-24983, CVE-2025-24993)
Tenable Security Response Team2025-03-12
Microsoft’s March 2025 Patch Tuesday Addresses 56 CVEs (CVE-2025-26633, CVE-2025-24983, CVE-2025-24993) | 6Critical 50Important 0Moderate <span class="number
securityboulevard.com
rss
forum
news
CVE-2024-43573 | Microsoft Windows up to Server 2022 23H2 MSHTML Platform HTML injection
vuldb.com2025-03-08
CVE-2024-43573 | Microsoft Windows up to Server 2022 23H2 MSHTML Platform HTML injection | A vulnerability, which was classified as critical, was found in Microsoft Windows. This affects an unknown part of the component MSHTML Platform. The manipulation leads to HTML injection. This vulnerability is uniquely identified as CVE-2024-43573. It is possible to initiate the attack remotely. Furthermore, there is an exploit
vuldb.com
rss
forum
news
14th October – Threat Intelligence Report
lorenf2024-12-02
14th October – Threat Intelligence Report | For the latest discoveries in cyber research for the week of 14th October, please download our Threat Intelligence Bulletin. TOP ATTACKS AND BREACHES Nonprofit healthcare organization Axis Health System has been hit by a ransomware attack by the Rhysida gang, leading to the theft of sensitive data, including mental health and substance abuse records. Rhysida [&#8230;] The post 14th October – Threat Intelligence Report appeared first on Check Point Research<
checkpoint.com
rss
forum
news
Data Breaches Digest - Week 41 2024
Dunkie ([email protected])2024-12-02
Data Breaches Digest - Week 41 2024 | Welcome to this week's Data Breaches Digest, a catalogue of links concerning Data Breaches and Cyber Security that were published on the Internet during the period between 7th October and 13th October 2024. 13th October <br
dbdigest.com
rss
forum
news
The October 2024 Security Update Review
Dustin Childs2024-12-02
The October 2024 Security Update Review | It’s the spooky season, and there’s nothing spookier than security patches – at least in my world. Microsoft and Adobe have released their latest patches, and no bones about it, there are some skeletons in those closets. Take a break from your regular activities and join us as we review the details of their latest security alerts. If you’d rather watch the full video recap covering the entire release, you can check it out here: Adobe Patches for
zerodayinitiative.com
rss
forum
news
Tripwire Patch Priority Index for October 2024 - tripwire.com
2024-11-05
Tripwire Patch Priority Index for October 2024 - tripwire.com | Description: Tripwire's October 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft. | News Content: Image Tripwire's October 2024 Patch Priority Index (PPI) brings together important vulnerabilities for Microsoft. First on the list are patches for Microsoft Edge, Office, Excel, and Visio that resolve remote code execution, elevation of privilege, and spoofing vulnerabilities. Next are patches that affect components of the core Windows operating system. These patches resolve over 80 vulnerabilities, including elevation of privilege, information disclosure, security feature bypass, denial of service, and remote code execution vulnerabilities. These
google.com
rss
forum
news

Social Media

CVE-2024-43573 – Microsoft Windows Security Vulnerability – October 2024: A critical vulnerability (CVE-2024-43573) in Microsoft Windows MSHTML platform allows for spoofing attacks.  Affected Platform  The vulnerability identified as CVE-2024-43573… https://t.co/fFOowi3dyJ https://t.co/OpIuOTT9lO
0
0
0
🚨 Microsoft’s October update addresses 117 CVEs, including two actively exploited vulnerabilities: CVE-2024-43572 (RCE in MMC) CVE-2024-43573 (Platform Spoofing in MSHTML) Critical CVE-2024-43468 (CVSS 9.8) could lead to RCE on servers. Apply patches ASAP to stay secure! https://t.co/wmFJMyeVJt
0
0
0
Urgent Security Alert: Critical Windows Vulnerability CVE-2024-43573 https://t.co/Sy5MkVIaKr
0
0
0
Actively exploited CVE : CVE-2024-43573
1
0
0
#ThreatProtection #CVE-2024-43573 - Microsoft Windows #MSHTML Platform #Spoofing #vulnerability, read more about Symantec's protection: https://t.co/Vl8ftRrAC5
0
0
1
For October 2024 Patch Tuesday, Microsoft has two under active exploitation: CVE-2024-43573, a spoofing bug affecting the Windows MSHTML Platform, and CVE-2024-43572, a remote code execution flaw in the Microsoft Management Console. @WindowsServer #GroupPolicy #ActiveDirectory
0
0
0
Salieron los parches de @Microsoft de Octubre 117 CVEs (CVE-2024-43572, CVE-2024-43573) https://t.co/c7W6h0NxTd https://t.co/LV5lVuB8v4
0
0
0
If you want to know more about the two #ZeroDay #Exploits under active attack: CVE-2024-43572 &amp; CVE-2024-43573 check the following links https://t.co/t89VNpz6zJ &amp; https://t.co/syAGGjX0hw for annotated reports with active #AI asisstance https://t.co/T9NIQOHW96
0
0
0
🚨 Microsoft patches 118 vulnerabilities, 2 actively exploited! Apply the latest updates ASAP to fix critical flaws like CVE-2024-43572 (RCE) and CVE-2024-43573 (MSHTML Spoofing). ⚠️ #CyberSecurity #PatchTuesday #Microsoft #ZeroDay #CVE202443572 #InfoSec
0
0
0
#Microsoft #patches two zero-days #exploited in the #wild (CVE-2024-43573, CVE-2024-43572) https://t.co/k5Hi8T1yB5
0
0
1

Affected Software

Configuration 1
TypeVendorProduct
OSMicrosoftwindows_10_21h2
OSMicrosoftwindows_10_1607
OSMicrosoftwindows_10_1809
OSMicrosoftwindows_10_1507
OSMicrosoftwindows_11_21h2
OSMicrosoftwindows_11_22h2
OSMicrosoftwindows_11_23h2
OSMicrosoftwindows_server_2016
OSMicrosoftwindows_server_2019
OSMicrosoftwindows_server_2022
OSMicrosoftwindows_server_2012
OSMicrosoftwindows_server_2022_23h2
OSMicrosoftwindows_10_22h2
Configuration 6
TypeVendorProduct
OSMicrosoftwindows_server_23h2

References

ReferenceLink
[email protected]https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573
WINDOWS MSHTML PLATFORM SPOOFING VULNERABILITYhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-43573

CWE Details

CWE IDCWE NameDescription
CWE-79Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')The software does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

CVE Radar

Real-time CVE Intelligence & Vulnerability Management Platform

CVE Radar provides comprehensive vulnerability intelligence by monitoring CVE databases, security advisories, and threat feeds. Get instant updates on new vulnerabilities, exploit details, and mitigation strategies specific to your assets.

Get Free Vulnerability Intelligence AccessAccess real-time CVE monitoring, exploit analysis, and threat intelligence