CVE-2023-33151: Microsoft Outlook Spoofing Vulnerability

Overview

Severity
Medium (CVSS 6.5)
CVSS Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C
Category
Spoofing
Exploit Status
Not Exploited
Exploitation Likelihood
Less Likely
Patch Tuesday
2023-Jul
Released
2023-07-11
Last Updated
2023-07-21
EPSS Score
0.57% (percentile: 68.7%)

FAQ

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do? The user would have to click on a specially crafted URL to be compromised by the attacker. Is the Preview Pane an attack vector for this vulnerability? Yes. The Preview Pane is an attack vector, but additional user interaction is required. What type of information could be disclosed by this vulnerability? Exploiting this vulnerability could allow the disclosure of NetNTLMv2 hashes. After I installed the July 2023 security updates for Outlook, I can no longer access UNC, SMB, or file:// type URLs from my Outlook. How do I prevent this from happening? The July 2023 Outlook security updates limit access to UNC, SMB, and file:// type URLs to only those the system identifies as Local, Intranet, or Trusted Sites. Additionally, when you click a link for one of these UNC, SMB, or file:// type URLs, a confirmation dialog will be displayed. To ensure continued access, add the URL, UNC, or FQDN path to the Trusted Site Zone as described in Intranet site is identified as Internet site - Windows Client | Microsoft Learn. For more information see Outlook blocks opening FQDN and IP address hyperlinks after installing protections for Microsoft Outlook Security Feature Bypass Vulnerability released July 11, 2023.

Affected Products (11)

Microsoft Office

  • Microsoft Office LTSC 2021 for 64-bit editions
  • Microsoft 365 Apps for Enterprise for 64-bit Systems
  • Microsoft 365 Apps for Enterprise for 32-bit Systems
  • Microsoft Office LTSC 2021 for 32-bit editions
  • Microsoft Outlook 2016 (64-bit edition)
  • Microsoft Office 2019 for 32-bit editions
  • Microsoft Outlook 2013 (32-bit editions)
  • Microsoft Outlook 2013 (64-bit editions)
  • Microsoft Outlook 2013 RT Service Pack 1
  • Microsoft Office 2019 for 64-bit editions
  • Microsoft Outlook 2016 (32-bit edition)

Security Updates (4)

Acknowledgments

Jordan Hopkins - Rootshell Security

Revision History

  • 2023-07-11: Information published.
  • 2023-07-21: Added an FAQ to explain what customers should do if they run into issues opening UNC, SMB, and file:// type URLs after installing the July 2023 Outlook updates. This is an informational change only.