CVE-2023-35311KEV · OVERDUECWE-367

Microsoft Outlook Security Feature Bypass Vulnerability

High · published July 11, 2023

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 8.8. It is confirmed in active exploitation. It sits in the 96.8th percentile for exploit probability.

1180
days past CISA
deadline
CVSS v3.1
8.8
EPSS
16%
Percentile
96.8
In the wild
Confirmed
What it is

🚨 A crafty security feature bypass in Microsoft Outlook could let attackers run amok! ⚡ Think of this like a trusted doorman who suddenly starts letting in anyone without checking IDs — a lax security measure that can easily lead to a full-blown party crash! An attacker could exploit this vulnerability to bypass important security features, potentially allowing them to access sensitive information, send malicious emails, or compromise accounts at will. This could lead to an avalanche of data breaches or phishing attempts, putting users at serious risk.

Put simply

Think of this like a trusted doorman who suddenly starts letting in anyone without checking IDs — a lax security measure that can easily lead to a full-blown party crash! This vulnerability arises from Outlook's improper enforcement of security features, allowing attackers to potentially exploit it without needing authentication. As a result, malicious entities can manipulate the email client and execute harmful actions.

What to do

An attacker could exploit this vulnerability to bypass important security features, potentially allowing them to access sensitive information, send malicious emails, or compromise accounts at will. This could lead to an avalanche of data breaches or phishing attempts, putting users at serious risk. Immediate action is required! Users should patch to the latest Outlook version to close this vulnerability. Additionally, review your security settings and policies to ensure proper safeguards are in place. You've got this! Stay proactive, patch up, and keep your Outlook secure! 🛡️

The record
Technical detail
CVSS v3.1
8.8 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
CVSS v4.0
Not supplied
EPSS
0.15522 · 96.8th percentile
Weakness
CWE-367 · Time-of-check Time-of-use (TOCTOU) Race Condition
Published
2023-07-11T22:15Z
KEV added
2023-07-11 · due 2023-08-01
Affected products (8)
ProductVersionsFixed in
microsoft/365_appsall versions—
microsoft/office_2019all versions—
microsoft/office_2019all versions—
microsoft/office_2021all versions—
microsoft/office_2021all versions—
microsoft/outlookall versions—
microsoft/outlookall versions—
microsoft/outlookall versions—
References (3)
EPSS history
Timeline
  • 11 JUL 17:03Z
    Microsoft Outlook Security Feature Bypass Vulnerability
    cvelistv5
  • 11 JUL 00:00Z
    Added to CISA KEV — remediate by Aug 1
    kev