PT-2023-1066 · Microsoft · 365 Apps For Enterprise+2

Published 2023-01-10 · Updated 2024-05-29 · CVE-2023-21741

Positive Technologies (AI Summary)

CVSS v2.0

8.5

High

Base vector

AV:N/AC:L/Au:N/C:C/I:N/A:P

Name of the Vulnerable Software and Affected Versions Microsoft Visio (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified)

Description The issue is related to insufficient protection of sensitive data in Microsoft Visio, Microsoft Office, and Microsoft 365 Apps for Enterprise. It allows a remote attacker to gain unauthorized access to protected information. The vulnerability can be exploited to obtain sensitive information and affect the system.

Recommendations For Microsoft Visio, update to a version that includes the fix for this issue. For Microsoft Office, apply the recommended configuration changes to protect sensitive data. For Microsoft 365 Apps for Enterprise, restrict access to sensitive information until a patch is available. As a temporary workaround, consider disabling access to sensitive data in Microsoft Visio, Microsoft Office, and Microsoft 365 Apps for Enterprise until a patch is available.

Fix

Information Disclosure

Out of bounds Read

Weakness Enumeration

CWE-200

CWE-125

Related Identifiers

BDU:2023-00199

CVE-2023-21741

Affected Products

365 Apps For Enterprise

Office

Office Visio

References · 6

• https://nvd.nist.gov/vuln/detail/CVE-2023-21741 · Security Note
• https://osv.dev/vulnerability/CVE-2023-21741 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/en-US/vulnerability/CVE-2023-21741 · Vendor Advisory
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21741 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-21741 · Security Note
• https://bdu.fstec.ru/vul/2023-00199 · Security Note