CVE-2023-36007: Microsoft Send Customer Voice survey from Dynamics 365 Spoofing Vulnerability
CVE-2023-36007 is a spoofing vulnerability in Microsoft Send Customer Voice survey from Dynamics 365, rated Important by Microsoft, with a CVSS 3.1 base score of 7.6 (High). An attacker can exploit it remotely over the network, with low privileges and only if a user takes an action. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 1.07% probability of exploitation activity in the next 30 days, higher than 65% of all scored vulnerabilities. Microsoft released the fix on 14 November 2023 in the November 2023 Patch Tuesday. It affects 1 product in 1 product family (Microsoft Dynamics).
Key facts
- CVE ID
- CVE-2023-36007
- Severity
- High CVSS 7.6
- Microsoft severity
- Important
- Impact
- Spoofing
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-79
- EPSS
- 1.07% (percentile 65%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- November 2023 Patch Tuesday
- Product families
- Microsoft Dynamics
CVSS score and vector
Microsoft scores CVE-2023-36007 at 7.6 (temporal 6.6) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:H/I:L/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | Low |
| Privileges required | Low |
| User interaction | Required |
| Scope | Changed |
| Confidentiality impact | High |
| Integrity impact | Low |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
NVD scores it 4.1 (MEDIUM) with CVSS:3.1/AV:N/AC:L/PR:L/UI:R/S:C/C:N/I:L/A:N.
Frequently asked questions (Microsoft)
According to the CVSS metric, privileges required is low (PR:L). What does that mean for this vulnerability?
Any authenticated attacker could trigger this vulnerability. It does not require admin or other elevated privileges.
According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?
The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.
According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability?
The attacker is only able to modify the content of the vulnerable link to redirect the victim to a malicious site.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
The user would have to click on a specially crafted URL to be compromised by the attacker.
According to the CVSS metric, successful exploitation of this vulnerability could lead to total loss of confidentiality (C:H)? What does that mean for this vulnerability?
An attacker who successfully exploited this vulnerability could craft a payload allowing them to access sensitive user data, which could result in unauthorized access to the victim's account or compromise of other confidential information.
Affected products (1)
Microsoft Dynamics
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Send Customer Voice survey from Dynamics 365 app | Release Notes | Security Update | 9.0.0.8 | Maybe |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 4.1 (MEDIUM)
- NVD weakness
- CWE-79
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| send customer voice survey from dynamics 365 | before 9.0.0.8 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36007 (Patch, Vendor Advisory)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36007 (Patch, Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |