PT-2023-7682 · Microsoft · Outlook

Published

2023-12-12

·

Updated

2024-11-20

·

CVE-2023-35636

CVSS v2.0

7.8

High

VectorAV:N/AC:L/Au:N/C:C/I:N/A:N
Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified)
Description The issue is related to the calendar sharing function in Microsoft Outlook, which can be exploited to access NT LAN Manager (NTLM) v2 hashed passwords. Attackers can steal NTLM password hashes via calendar invites by adding two headers to an email. This exploit enables attackers to intercept NTLM v2 hashes, which are used for authentication in Microsoft Windows systems. The estimated number of potentially affected devices worldwide is around 910,000 services, mainly distributed in Germany, the United States, and other countries.
Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Exploit

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2023-08749
CVE-2023-35636

Affected Products

Outlook