microsoft 365-apps CVE-2023-21715 is a vulnerability in Microsoft 365 Apps
Published on February 14, 2023

Microsoft Publisher Security Features Bypass Vulnerability

Vendor Advisory NVD

Known Exploited Vulnerability

This Microsoft Office Security Feature Bypass Vulnerability is part of CISA's list of Known Exploited Vulnerabilities. Microsoft Office contains a security feature bypass vulnerability which allows for a local, authenticated attack on a targeted system.

The following remediation steps are recommended / required by March 7, 2023: Apply updates per vendor instructions.

Vulnerability Analysis

CVE-2023-21715 can be exploited with local system access, requires user interaction and a small amount of user privileges. This vulnerability is considered to have a low attack complexity. It has an exploitability score of 1.3 out of four. The potential impact of an exploit of this vulnerability is considered to be very high.

What is an AuthZ Vulnerability?

The software performs an authorization check when an actor attempts to access a resource or perform an action, but it does not correctly perform the check. This allows attackers to bypass intended access restrictions.

CVE-2023-21715 has been classified to as an AuthZ vulnerability or weakness.


Products Associated with CVE-2023-21715

You can be notified by stack.watch whenever vulnerabilities like CVE-2023-21715 are published in these products:

 

What versions of 365 Apps are vulnerable to CVE-2023-21715?