TRY NOW
Patch Tuesday

Microsoft Patch Tuesday – May 2024

6 min. read
14/05/2024
By Esben Dochy
Microsoft Patch Tuesday

⚡ TL;DR | Go Straight to the May 202Patch Tuesday Audit Report

Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The May 2024 edition of Patch Tuesday brings us 61 new fixes, with 1 rated as critical. We’ve listed the most important changes below.

Windows MSHTML Platform Security Feature Bypass Vulnerability

The frist highlight of this month isn’t a vulnerability rated as “critical”, however its one that has already been exploited. CVE-2024-30040 is a vulnerability bypasses OLE mitigations in Microsoft 365 and Microsoft Office.

OLE (Object Linking and Embedding) mitigations in Microsoft 365 refer to security measures designed to protect against vulnerabilities related to OLE technology, commonly used for embedding objects between documents, by restricting its usage to prevent potential exploitation by malicious actors.

To exploit this vulnerability an attacker would need to convince a user to open a malicious document at which point the attacker could execute arbitrary code in the context of that user.

Windows DWM Core Library Vulnerabilities

Next up are multiple vulnerabilities in the Windows DWM Core Library. The Windows Desktop Window Manager (DWM) Core Library is a component responsible for managing graphical elements, including rendering windows and applying visual effects, to provide a consistent user interface experience in Windows operating systems.

The most critical vulnerability is CVE-2024-30051 which has also been exploited already. This elevation of privilege vulnerability could give an attacker SYSTEM privileges if exploited successfully. Microsoft hasn’t shared details on how exploitation can take place.

Additionally, there were three other vulnerabilities in the Windows DWM Core Library, two EoP and one information disclosure vulnerability.

Microsoft SharePoint Server Remote Code Execution Vulnerability

Last but not least, we have the only critical vulnerability of this month. A SharePoint RCE vulnerability. While there is no exploitation detected yet, Microsoft has listed it as being “more likely” to be exploited.

In order to exploit the vulnerability, Microsoft lists the following for CVE-2024-30044:

An authenticated attacker with Site Owner permissions or higher could upload a specially crafted file to the targeted Sharepoint Server and craft specialized API requests to trigger deserialization of file’s parameters. This would enable the attacker to perform remote code execution in the context of the Sharepoint Server.

msrc.microsoft.com

Run the Patch Tuesday May 2024 Audit

To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

The Lansweeper Patch Tuesday report is automatically added to your Lansweeper Site. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one report, automatically added every patch Tuesday!

Patch Tuesday May 2024 CVE Codes & Titles

CVE NumberCVE Title
CVE-2024-30040Windows MSHTML Platform Security Feature Bypass Vulnerability
CVE-2024-30051Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-28902Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-26207Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-26217Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-28900Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-23593Lenovo: CVE-2024-23593 Modify Boot Manager and Escalate Privileges
CVE-2024-32002CVE-2024-32002 Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
CVE-2024-29997Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29998Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-29999Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30000Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30001Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30002Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30003Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30004Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30005Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30006Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability
CVE-2024-30007Microsoft Brokering File System Elevation of Privilege Vulnerability
CVE-2024-30008Windows DWM Core Library Information Disclosure Vulnerability
CVE-2024-30009Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30010Windows Hyper-V Remote Code Execution Vulnerability
CVE-2024-30011Windows Hyper-V Denial of Service Vulnerability
CVE-2024-30012Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30014Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30015Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30016Windows Cryptographic Services Information Disclosure Vulnerability
CVE-2024-30017Windows Hyper-V Remote Code Execution Vulnerability
CVE-2024-30018Windows Kernel Elevation of Privilege Vulnerability
CVE-2024-30019DHCP Server Service Denial of Service Vulnerability
CVE-2024-30020Windows Cryptographic Services Remote Code Execution Vulnerability
CVE-2024-30021Windows Mobile Broadband Driver Remote Code Execution Vulnerability
CVE-2024-30022Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30023Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30053Azure Migrate Cross-Site Scripting Vulnerability
CVE-2024-26238Microsoft PLUGScheduler Scheduled Task Elevation of Privilege Vulnerability
CVE-2024-29994Microsoft Windows SCSI Class System File Elevation of Privilege Vulnerability
CVE-2024-30024Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30027NTFS Elevation of Privilege Vulnerability
CVE-2024-30028Win32k Elevation of Privilege Vulnerability
CVE-2024-30029Windows Routing and Remote Access Service (RRAS) Remote Code Execution Vulnerability
CVE-2024-30030Win32k Elevation of Privilege Vulnerability
CVE-2024-30031Windows CNG Key Isolation Service Elevation of Privilege Vulnerability
CVE-2024-30033Windows Search Service Elevation of Privilege Vulnerability
CVE-2024-30036Windows Deployment Services Information Disclosure Vulnerability
CVE-2024-30039Windows Remote Access Connection Manager Information Disclosure Vulnerability
CVE-2024-30041Microsoft Bing Search Spoofing Vulnerability
CVE-2024-30042Microsoft Excel Remote Code Execution Vulnerability
CVE-2024-30043Microsoft SharePoint Server Information Disclosure Vulnerability
CVE-2024-30045.NET and Visual Studio Remote Code Execution Vulnerability
CVE-2024-30046Visual Studio Denial of Service Vulnerability
CVE-2024-30047Dynamics 365 Customer Insights Spoofing Vulnerability
CVE-2024-30048Dynamics 365 Customer Insights Spoofing Vulnerability
CVE-2024-32004GitHub: CVE-2024-32004 Remote Code Execution while cloning special-crafted local repositories
CVE-2024-30054Microsoft Power BI Client JavaScript SDK Information Disclosure Vulnerability
CVE-2024-26211Windows Remote Access Connection Manager Elevation of Privilege Vulnerability
CVE-2024-29996Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-30044Microsoft SharePoint Server Remote Code Execution Vulnerability
CVE-2024-30050Windows Mark of the Web Security Feature Bypass Vulnerability
CVE-2024-30025Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-30032Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-30034Windows Cloud Files Mini Filter Driver Information Disclosure Vulnerability
CVE-2024-30035Windows DWM Core Library Elevation of Privilege Vulnerability
CVE-2024-30037Windows Common Log File System Driver Elevation of Privilege Vulnerability
CVE-2024-30038Win32k Elevation of Privilege Vulnerability
CVE-2024-30049Windows Win32 Kernel Subsystem Elevation of Privilege Vulnerability
CVE-2024-30059Microsoft Intune for Android Mobile Application Management Tampering Vulnerability
NO CREDIT CARD REQUIRED

Ready to get started?
You’ll be up and running in no time.

Explore all our features, free for 14 days.