Actively exploited · Published Feb 14, 2023 · Assigned by microsoft
CVE-2023-21715Microsoft Publisher Security Feature Bypass Vulnerability
High 7.3 Exploited
In plain English
A high-severity incorrect authorization in Microsoft 365 Apps for Enterprise from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on February 14, 2023). The chance it is exploited in the next 30 days is estimated at 12.0% (higher than 96% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)7.3High
Exploit odds (30 days)12.0%top 3.8% of all CVEs
Exploited in the wildYesCISA KEV since Feb 14, 2023
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Mar 7, 2023.
Official description
Microsoft Publisher Security Feature Bypass Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
Weakness: CWE-863 · Vector: CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
References
- Microsoft Publisher Security Feature Bypass Vulnerability vendor-advisory, patch
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21715 government-resource