CVE-2023-21715KEV · OVERDUECWE-863broken-access-control

Microsoft Office Publisher Security Feature Bypass Vulnerability

High · published February 15, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.3. It is confirmed in active exploitation. It sits in the 96.1th percentile for exploit probability.

1327
days past CISA
deadline
CVSS v3.1
7.3
EPSS
12%
Percentile
96.1
In the wild
Confirmed
What it is

⚡ Microsoft Publisher has a sneaky security feature bypass vulnerability that can leave your documents wide open! 🔥 Think of this like a hotel that forgot to change the locks on a few rooms—if a guest checks in with the right information, they can waltz right into any room without a key. Just like that, this bug lets attackers sidestep security measures and access sensitive content! An attacker exploiting this vulnerability could gain unauthorized access to sensitive files, potentially stealing or tampering with critical data. It’s like handing over the keys to your entire document vault! If you're using Publisher, this could lead to seriously devastating breaches, so it’s time to act fast!

Put simply

Think of this like a hotel that forgot to change the locks on a few rooms—if a guest checks in with the right information, they can waltz right into any room without a key. Just like that, this bug lets attackers sidestep security measures and access sensitive content! This vulnerability allows attackers to bypass security features in Microsoft Publisher, enabling them to open malicious documents without the expected safeguards. Essentially, it tricks the software into thinking everything is secure when it's not!

What to do

An attacker exploiting this vulnerability could gain unauthorized access to sensitive files, potentially stealing or tampering with critical data. It’s like handing over the keys to your entire document vault! If you're using Publisher, this could lead to seriously devastating breaches, so it’s time to act fast! To protect yourself, immediately update to the latest version of Microsoft Publisher. Ensure that your security settings are properly configured and consider training staff on safe document handling practices. Don’t leave any virtual doors unlocked! You've got this! By following these steps, you can secure your documents and maintain your security hero status! 🛡️

The record
Technical detail
CVSS v3.1
7.3 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.12011 · 96.1th percentile
Weakness
CWE-863 · Incorrect Authorization
Published
2023-02-15T01:15Z
KEV added
2023-02-14 · due 2023-03-07
Affected products (1)
ProductVersionsFixed in
microsoft/365_appsall versions—
References (3)
EPSS history
Timeline
  • 14 FEB 19:33Z
    Microsoft Publisher Security Feature Bypass Vulnerability
    cvelistv5
  • 14 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 7
    kev