CVE-2024-49147

CRITICAL

Microsoft Update Catalog - Insecure Deserialization

Title source: rule

Description

Deserialization of untrusted data in Microsoft Update Catalog allows an unauthorized attacker to elevate privileges on the website’s webserver.

References (1)

Scores

CVSS v3 9.3
EPSS 0.0043
EPSS Percentile 62.6%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:C/C:H/I:L/A:N

Classification

CWE
CWE-502
Status published

Affected Products (1)

microsoft/update_catalog

Timeline

Published Dec 12, 2024
Tracked Since Feb 18, 2026