CVE-2023-21715: Microsoft Publisher Security Feature Bypass Vulnerability

Overview

Severity
High (CVSS 7.3)
CVSS Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
Category
Security Feature Bypass
Exploit Status
Actively Exploited
Exploitation Likelihood
Detected
Patch Tuesday
2023-Feb
Released
2023-02-14
Last Updated
2023-04-14
EPSS Score
0.65% (percentile: 70.9%)
CISA KEV
Listed — due 2023-03-07

FAQ

According to the CVSS metric, the attack vector is local (AV:L), privileges are required (PR:L) and user interaction is required (UI:R). How could an attacker exploit this security feature bypass vulnerability? The attack itself is carried out locally by a user with authentication to the targeted system. An authenticated attacker could exploit the vulnerability by convincing a victim, through social engineering, to download and open a specially crafted file from a website which could lead to a local attack on the victim computer. According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H), integrity (I:H), and availability (A:H). What does that mean for this vulnerability? An attacker who successfully exploits this vulnerability could perform a local attack potentially enabling access to the victim user's information, the ability to alter information, or the ability to cause downtime to the target environment. What kind of security feature could be bypassed by successfully exploiting this vulnerability? An attacker who successfully exploited this vulnerability could bypass Office macro policies used to block untrusted or malicious files.

Affected Products (2)

Microsoft Office

  • Microsoft 365 Apps for Enterprise for 64-bit Systems
  • Microsoft 365 Apps for Enterprise for 32-bit Systems

Acknowledgments

Hidetake Jo, Rick Cole, Charlie Hurel, and Matthew Mesa, Haifei Li with <a href="https://expmon.com/">EXPMON</a>

Revision History

  • 2023-02-14: Information published.
  • 2023-02-15: Acknowledgement added. This is an informational change only.
  • 2023-02-21: Updated acknowledgment. This is an informational change only.
  • 2023-04-14: Added FAQ information. This is an informational change only.