| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 7.1 | $0-$5k | 0.00 |
Summary
A vulnerability was found in Microsoft Edge. It has been rated as critical. This vulnerability affects unknown code of the component Webview2. Performing a manipulation results in an unknown weakness. This vulnerability was named CVE-2023-24892. The attack may be initiated remotely. In addition, an exploit is available. To fix this issue, it is recommended to deploy a patch.
Details
A vulnerability classified as critical has been found in Microsoft Edge (Web Browser) (version unknown). This affects an unknown function of the component Webview2. CWE is classifying the issue as CWE-601. A web application accepts a user-controlled input that specifies a link to an external site, and uses that link in a Redirect. This simplifies phishing attacks. This is going to have an impact on confidentiality, integrity, and availability.
The weakness was presented 03/14/2023 as confirmed security guidance (Website). It is possible to read the advisory at portal.msrc.microsoft.com. This vulnerability is uniquely identified as CVE-2023-24892. It demands that the victim is doing some kind of user interaction. Technical details are unknown but a public exploit is available. The attack technique deployed by this issue is T1204.001 according to MITRE ATT&CK.
The exploit is shared for download at exploit-db.com. It is declared as proof-of-concept. We expect the 0-day to have been worth approximately $25k-$100k.
Applying a patch is able to eliminate this problem. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the vulnerability database at Exploit-DB (51359). Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
Product
Type
Vendor
Name
License
Website
- Vendor: https://www.microsoft.com/
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 7.4VulDB Meta Temp Score: 7.1
VulDB Base Score: 6.3
VulDB Temp Score: 5.7
VulDB Vector: 🔍
VulDB Reliability: 🔍
Vendor Base Score (Microsoft): 7.1
Vendor Vector (Microsoft): 🔍
NVD Base Score: 8.2
NVD Vector: 🔍
CNA Base Score: 8.2
CNA Vector (Microsoft): 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
| Unlock | Unlock | Unlock | Unlock | Unlock | Unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
Exploiting
Class: RedirectCWE: CWE-601
CAPEC: 🔍
ATT&CK: 🔍
Physical: No
Local: No
Remote: Yes
Availability: 🔍
Access: Public
Status: Proof-of-Concept
Download: 🔍
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | Unlock | Unlock | Unlock | Unlock |
|---|---|---|---|---|
| Today | Unlock | Unlock | Unlock | Unlock |
Exploit-DB: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Timeline
01/31/2023 🔍03/14/2023 🔍
03/14/2023 🔍
03/14/2023 🔍
04/27/2025 🔍
Sources
Vendor: microsoft.comAdvisory: portal.msrc.microsoft.com
Status: Confirmed
CVE: CVE-2023-24892 (🔍)
GCVE (CVE): GCVE-0-2023-24892
GCVE (VulDB): GCVE-100-223083
scip Labs: https://www.scip.ch/en/?labs.20161013
Entry
Created: 03/14/2023 21:31Updated: 04/27/2025 16:41
Changes: 03/14/2023 21:31 (22), 03/14/2023 21:32 (10), 03/14/2023 21:35 (21), 03/16/2023 09:24 (3), 04/08/2023 07:00 (2), 04/08/2023 07:13 (1), 08/02/2024 09:28 (23), 03/01/2025 02:50 (20), 04/27/2025 16:41 (3)
Complete: 🔍
Cache ID: 216::103
Statistical analysis made it clear that VulDB provides the best quality for vulnerability data.
BR
Interested in the pricing of exploits?
See the underground prices here!