Vulnerability · Published Aug 8, 2023 · Assigned by microsoft
CVE-2023-36897Visual Studio Tools for Office Runtime Spoofing Vulnerability
High 8.1
In plain English
A high-severity improper input validation in Microsoft 365 Apps for Enterprise from Microsoft. There are no confirmed reports of exploitation so far. The chance it is exploited in the next 30 days is estimated at 1.7% (higher than 77% of all known vulnerabilities).
Severity (CVSS 3.1)8.1High
Exploit odds (30 days)1.7%top 22.9% of all CVEs
Exploited in the wildNo reportsCISA SSVC: none
Attack toolingNoneno public tooling known
Official description
Visual Studio Tools for Office Runtime Spoofing Vulnerability
Affected products (as reported)
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office 2019 | 19.0.0 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Office LTSC 2021 | 16.0.1 – before https://aka.ms/OfficeSecurityReleases |
| Microsoft | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | 15.9.0 – before 15.9.56 |
| Microsoft | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | 16.11.0 – before 16.11.29 |
| Microsoft | Microsoft Visual Studio 2022 version 17.2 | 17.2.0 – before 17.2.18 |
| Microsoft | Microsoft Visual Studio 2022 version 17.4 | 17.4.0 – before 17.4.10 |
| Microsoft | Microsoft Visual Studio 2022 version 17.6 | 17.6.0 – before 17.6.6 |
| Microsoft | Visual Studio 2010 Tools for Office Runtime | 10.0.0 – before 10.0.60910 |
Weakness: CWE-20 · Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:N/E:P/RL:O/RC:C
References
- Visual Studio Tools for Office Runtime Spoofing Vulnerability vendor-advisory, patch