Microsoft Office Security Feature Bypass Vulnerability
🔗 CVE IDs covered (1)
📋 Description
Is the Attachment Preview Pane an attack vector for this vulnerability? Yes. The attachment Preview Pane that is accessed when a user clicks to preview an attached file is an attack vector; however, the email Preview Pane itself is not.
What kind of security feature could be bypassed by successfully exploiting this vulnerability? The attacker would be able to bypass the protection in Outlook that prevents a potentially dangerous extension from being uploaded and downloaded.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N), with minor loss of integrity (I:N) and availability (A:L). What does that mean for this vulnerability? While we cannot rule out the impact to Confidentiality, Integrity, and Availability, the ability to exploit this vulnerability by itself is limited. An attacker would need to combine this with other vulnerabilities to perform an attack.
🎯 Affected products13
- Microsoft 365 Apps for Enterprise for 32-bit Systems
- Microsoft 365 Apps for Enterprise for 64-bit Systems
- Microsoft Office 2013 RT Service Pack 1
- Microsoft Office 2013 Service Pack 1 (32-bit editions)
- Microsoft Office 2013 Service Pack 1 (64-bit editions)
- Microsoft Office 2016 (32-bit edition)
- Microsoft Office 2016 (64-bit edition)
- Microsoft Office 2019 for 32-bit editions
- Microsoft Office 2019 for 64-bit editions
- Microsoft Office 2019 for Mac
- Microsoft Office LTSC 2021 for 32-bit editions
- Microsoft Office LTSC 2021 for 64-bit editions
- Microsoft Office LTSC for Mac 2021
✅ Remediation
KBClick to Run (Security Update) — fixed build https://aka.ms/OfficeSecurityReleases KBRelease Notes (Security Update) — fixed build 16.77.23091003 KB5002457 (Security Update) — fixed build 16.0.5413.1000 KB5002477 (Security Update) — fixed build 15.0.5589.1000
🔗 References (9)
- advisoryhttps://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36767
- referencehttps://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
- patchhttps://go.microsoft.com/fwlink/p/?linkid=831049
- patchhttps://www.microsoft.com/download/details.aspx?familyid=d9e2a1b7-ec5b-4843-98e1-d67581c252e9
- referencehttps://support.microsoft.com/help/5002457
- patchhttps://www.microsoft.com/download/details.aspx?familyid=3f90655f-5490-483e-a6cc-2ac8e8a47fa7
- referencehttps://support.microsoft.com/help/5002477
- patchhttps://www.microsoft.com/download/details.aspx?familyid=d23ec7ea-1e1f-46e0-8f18-802df462ed14
- patchhttps://www.microsoft.com/download/details.aspx?familyid=a6f71299-e20a-434e-84b2-28bfe10beaeb