CVE-2025-24071

Published Mar 11, 2025

Last updated 8 months ago

CVSS medium 6.5

Windows

File Explorer

Overview

Description: Exposure of sensitive information to an unauthorized actor in Windows File Explorer allows an unauthorized attacker to perform spoofing over a network.
Source: secure@microsoft.com
NVD status: Analyzed
Products: windows_10_1507, windows_10_1607, windows_10_1809, windows_11_23h2, windows_11_24h2, windows_server_2012, windows_server_2016, windows_server_2019, windows_server_2022, windows_server_2022_23h2, windows_server_2025

Risk scores

CVSS 3.1

Type: Secondary
Base score: 6.5
Impact score: 3.6
Exploitability score: 2.8
Vector string: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
Severity: MEDIUM

Weaknesses

secure@microsoft.com: CWE-200

Hype score: Not currently trending

Configurations

[
  {
    "nodes": [
      {
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "6997DE6E-CBAD-4690-A68C-8F10E477DCC2",
            "versionEndExcluding": "10.0.10240.20947",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "3CBCF6D9-5085-473C-82F5-98BC246A9C4C",
            "versionEndExcluding": "10.0.10240.20947",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "0CF0E174-4692-4AA3-B72E-12E73A1BDBE5",
            "versionEndExcluding": "10.0.14393.7876",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "340EF5F8-D4F5-4AD8-9D80-1DEC2F376BE5",
            "versionEndExcluding": "10.0.14393.7876",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "67C8DCD7-90C4-431F-BD03-FDFDE170E748",
            "versionEndExcluding": "10.0.17763.7009",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
            "matchCriteriaId": "05169574-28AB-4E42-B3DE-710574BB1AD3",
            "versionEndExcluding": "10.0.17763.7009",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_23h2:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "77DC7D9D-F85F-41B4-A944-D27B388A1157",
            "versionEndExcluding": "10.0.22631.5039",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:arm64:*",
            "matchCriteriaId": "37ACC628-E175-4240-8166-C45995518331",
            "versionEndExcluding": "10.0.26100.3476",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_11_24h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "71D7DCBF-A571-4A16-8F32-FE24150917C0",
            "versionEndExcluding": "10.0.26100.3476",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*",
            "matchCriteriaId": "DB18C4CE-5917-401E-ACF7-2747084FD36E",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C7610CDB-A02B-4C62-B17F-6DCE2B3DE4F0",
            "versionEndExcluding": "10.0.14393.7876",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "D271422D-A29F-4DBF-BF72-BCD90E393A5A",
            "versionEndExcluding": "10.0.17763.7009",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
            "matchCriteriaId": "C1426FF0-A402-4149-9F2B-0FA3CEB4BB5B",
            "versionEndExcluding": "10.0.20348.3328",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2022_23h2:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "96046A7B-76A1-4DCF-AEA5-25344D37E492",
            "versionEndExcluding": "10.0.25398.1486",
            "vulnerable": true
          },
          {
            "criteria": "cpe:2.3:o:microsoft:windows_server_2025:*:*:*:*:*:*:x64:*",
            "matchCriteriaId": "DFE44B43-DB8C-46E0-8344-C22ED7406A50",
            "versionEndExcluding": "10.0.26100.3476",
            "vulnerable": true
          }
        ],
        "negate": false,
        "operator": "OR"
      }
    ]
  }
]

References

Sources include official advisories and independent security research.

Overview

Risk scores

CVSS 3.1

Weaknesses

Social media

Configurations

Related CVEs

References