Actively exploited · Published Jul 11, 2023 · Assigned by microsoft
CVE-2023-35311Microsoft Outlook Security Feature Bypass Vulnerability
High 8.8 Exploited
In plain English
A high-severity security flaw in Microsoft 365 Apps for Enterprise from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on July 11, 2023). The chance it is exploited in the next 30 days is estimated at 15.5% (higher than 97% of all known vulnerabilities). Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
CISA guidance
Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.
Federal agencies must remediate by Aug 1, 2023.
Official description
Microsoft Outlook Security Feature Bypass Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office 2019 | 19.0.0 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Outlook 2016 | 16.0.0.0 – before 16.0.5404.1000 |
| Microsoft | Microsoft Outlook 2013 | 14.0.0 – before 15.0.5571.1000 |
| Microsoft | Microsoft Outlook 2013 Service Pack 1 | 15.0.0.0 – before 15.0.5571.1000 |
Weakness: CWE-367 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C
References
- Microsoft Outlook Security Feature Bypass Vulnerability vendor-advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-35311 government-resource