Actively exploited · Published Mar 14, 2023 · Assigned by microsoft
CVE-2023-23397Microsoft Outlook Elevation of Privilege Vulnerability
Critical 9.8 Exploited
In plain English
A critical-severity improper input validation in Microsoft 365 Apps for Enterprise from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on March 14, 2023). The chance it is exploited in the next 30 days is estimated at 97.2% (higher than 99.9% of all known vulnerabilities). Ready-made attack tooling exists: public proof-of-concept code. Apply updates per vendor instructions.
Severity (CVSS 3.1)9.8Critical
Exploit odds (30 days)97.2%top 0.1% of all CVEs
Exploited in the wildYesCISA KEV since Mar 14, 2023
Attack tooling1Public PoC
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Apr 4, 2023.
Official description
Microsoft Outlook Elevation of Privilege Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Outlook 2016 | 16.0.0.0 – before 16.0.5387.1000 |
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office 2019 | 19.0.0 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Outlook 2013 Service Pack 1 | 15.0.0.0 – before 15.0.5537.1000 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
References
- Microsoft Outlook Elevation of Privilege Vulnerability vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-23397 government-resource