CVE-2023-29360KEV · OVERDUECWE-822

Microsoft Streaming Service Elevation of Privilege Vulnerability

High · published June 13, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.4. It is confirmed in active exploitation. It sits in the 97.6th percentile for exploit probability.

946
days past CISA
deadline
CVSS v3.1
8.4
EPSS
22%
Percentile
97.6
In the wild
Confirmed
What it is

⚡ A sneaky elevation of privilege flaw in Microsoft’s Streaming Service is actively being exploited! 🎥🦸‍♂️ Think of it like a VIP pass that lets anyone backstage at a concert — once inside, they can change the entire show! This vulnerability allows attackers to gain unauthorized access and control over resources they shouldn't, just like an uninvited guest taking over the soundboard. An attacker could escalate privileges and take control of sensitive resources, potentially leading to data breaches or unauthorized actions across the network. The consequences could be absolutely devastating, affecting not just the system but the entire organization’s security posture!

Put simply

Think of it like a VIP pass that lets anyone backstage at a concert — once inside, they can change the entire show! This vulnerability allows attackers to gain unauthorized access and control over resources they shouldn't, just like an uninvited guest taking over the soundboard. This vulnerability occurs due to improper validation of user inputs in the Microsoft Streaming Service, allowing attackers to gain elevated privileges on affected systems. It’s a critical oversight that can be exploited without needing prior authentication.

What to do

An attacker could escalate privileges and take control of sensitive resources, potentially leading to data breaches or unauthorized actions across the network. The consequences could be absolutely devastating, affecting not just the system but the entire organization’s security posture! To mitigate the risk, immediately patch affected systems with the latest updates from Microsoft. Additionally, enforce strict access controls and monitor logs for any unusual activity. Don’t wait — this is urgent! You've got this! By taking these steps, you can significantly enhance your security and protect your environment. 🛡️

The record
Technical detail
CVSS v3.1
8.4 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.21620 · 97.6th percentile
Weakness
CWE-822 · Untrusted Pointer Dereference
Published
2023-06-13T23:26Z
KEV added
2024-02-29 · due 2024-03-21
EPSS history
Timeline
  • 29 FEB 00:00Z
    Added to CISA KEV — remediate by Mar 21
    kev
  • 13 JUN 23:26Z
    Microsoft Streaming Service Elevation of Privilege Vulnerability
    cvelistv5