CVE-2024-29049: 
vulnerability analysis and mitigation

Microsoft Edge (Chromium-based) Webview2 Spoofing Vulnerability, identified as CVE-2024-29049, was disclosed on April 4, 2024. The vulnerability affects Microsoft Edge Chromium and its Webview2 component, specifically versions up to 122.0.2365.120 and versions from 123.0.2420.53 up to 123.0.2420.81 (NVD).

The vulnerability has been classified with a CVSS v3.1 base score of 4.7 (Medium) according to NIST, with a vector string of CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. Microsoft's own assessment rated it slightly lower at 4.1 (Medium) with a vector string of CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:L/I:L/A:N. The vulnerability is categorized under CWE-79, which relates to Improper Neutralization of Input During Web Page Generation (Cross-site Scripting) (NVD).

The vulnerability could potentially lead to spoofing attacks, with low impacts on both confidentiality and integrity, while having no impact on availability. The scope is changed, indicating that the vulnerability could affect resources beyond its security scope (NVD).

The vulnerability requires network access (AV:N) with high attack complexity (AC:H). No privileges are required (PR:N), but user interaction is needed (UI:R). The attack vector suggests that while the vulnerability is exploitable, it requires specific conditions and user interaction to be successful (NVD).

Microsoft has released security updates to address this vulnerability. Users should update to Microsoft Edge version 123.0.2420.81 or later. The fix was included in the April 4, 2024 security update release (Microsoft Learn).