PT-2023-1782 · Microsoft · Office+2

Tecr0C · Published 2023-03-14 · Updated 2024-05-29 · CVE-2023-23399

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Excel (affected versions not specified) Office (affected versions not specified) Office 365 (affected versions not specified)

Description The issue is related to insufficient input validation in Microsoft office packages, including Excel, Office, and Office 365. This can be exploited by a remote attacker using a specially crafted file to execute arbitrary code.

Recommendations For Microsoft Excel, consider disabling the execution of external files until a patch is available. For Office, restrict access to potentially vulnerable components to minimize the risk of exploitation. For Office 365, avoid using potentially vulnerable features until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

RCE

Out of bounds Read

Weakness Enumeration

CWE-20

CWE-125

Related Identifiers

BDU:2023-01377

CVE-2023-23399

Affected Products

Office Excel

Office

Office 365

References · 10

• 🔥 https://exploit-db.com/exploits/51328 · Exploit
• https://osv.dev/vulnerability/CVE-2023-23399 · Vendor Advisory
• https://bdu.fstec.ru/vul/2023-01377 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23399 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-23399 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2023-23399 · Security Note
• https://t.me/cvenotify/46548 · Telegram Post
• https://t.me/cibsecurity/59999 · Telegram Post
• https://t.me/cvenotify/81319 · Telegram Post
• https://t.me/cybersecuritytechnologies/8220 · Telegram Post