PT-2023-1782 · Microsoft · Office+2

Tecr0C · Publicado 2023-03-14 · Atualizado 2024-05-29 · CVE-2023-23399

Positive Technologies (AI Summary)

CVSS v3.1

7.8

Alta

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Excel (affected versions not specified) Office (affected versions not specified) Office 365 (affected versions not specified)

Description The issue is related to insufficient input validation in Microsoft office packages, including Excel, Office, and Office 365. This can be exploited by a remote attacker using a specially crafted file to execute arbitrary code.

Recommendations For Microsoft Excel, consider disabling the execution of external files until a patch is available. For Office, restrict access to potentially vulnerable components to minimize the risk of exploitation. For Office 365, avoid using potentially vulnerable features until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Out of bounds Read

Enumeração de Fraquezas

CWE-20

CWE-125

Identificadores relacionados

BDU:2023-01377

CVE-2023-23399

Produtos afetados

Office Excel

Office

Office 365

Referências · 10

• 🔥 https://exploit-db.com/exploits/51328 · Exploit
• https://t.me/cvenotify/46548 · Publicação no Telegram
• https://t.me/cibsecurity/59999 · Publicação no Telegram
• https://osv.dev/vulnerability/CVE-2023-23399 · Aviso do Fabricante
• https://bdu.fstec.ru/vul/2023-01377 · Nota de Segurança
• https://t.me/cvenotify/81319 · Publicação no Telegram
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23399 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23399 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2023-23399 · Nota de Segurança
• https://t.me/cybersecuritytechnologies/8220 · Publicação no Telegram