CVE-2023-35311 - Vulnerability Details - OpenCVE

ReportizFlow

Microsoft Outlook Security Feature Bypass Vulnerability

No CVSS v4.0

Attack Vector Network

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

No CVSS v2

This CVE is not in the KEV list.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	365 Apps Office Office Long Term Servicing Channel Outlook

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:365_apps:-::::enterprise:::
	cpe:2.3:a:microsoft:office:2019:::::::*
	cpe:2.3:a:microsoft:office:2021::::ltsc:::
	cpe:2.3:a:microsoft:outlook:2013:-:-::-:-::*
	cpe:2.3:a:microsoft:outlook:2013:sp1:::rt:::*
	cpe:2.3:a:microsoft:outlook:2016:::::::*

No data.

References

Link	Providers
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35311

History

Wed, 14 Aug 2024 16:00:00 +0000

Type	Values Removed	Values Added
Weaknesses	NVD-CWE-noinfo
CPEs		cpe:2.3:a:microsoft:office:2021::::ltsc:::

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2023-07-11T17:03:27.227Z

Updated: 2024-08-02T16:23:59.684Z

Reserved: 2023-06-14T23:09:47.613Z

Link: CVE-2023-35311

Vulnrichment

No data.

NVD

Status : Modified

Published: 2023-07-11T18:15:17.177

Modified: 2024-11-21T08:08:10.387

Link: CVE-2023-35311

Redhat

No data.

{"dataType": "CVE_RECORD", "dataVersion": "5.1", "cveMetadata": {"cveId": "CVE-2023-35311", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "state": "PUBLISHED", "assignerShortName": "microsoft", "dateReserved": "2023-06-14T23:09:47.613Z", "datePublished": "2023-07-11T17:03:27.227Z", "dateUpdated": "2024-08-02T16:23:59.684Z"}, "containers": {"cna": {"title": "Microsoft Outlook Security Feature Bypass Vulnerability", "datePublic": "2023-07-11T07:00:00+00:00", "affected": [{"vendor": "Microsoft", "product": "Microsoft 365 Apps for Enterprise", "cpes": ["cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*"], "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office LTSC 2021", "cpes": ["cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*"], "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.1", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Office 2019", "cpes": ["cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*"], "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "19.0.0", "lessThan": "https://aka.ms/OfficeSecurityReleases", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook 2016", "cpes": ["cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:x86:*:*", "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:x64:*:*"], "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "16.0.0.0", "lessThan": "16.0.5404.1000", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook 2013", "cpes": ["cpe:2.3:a:microsoft:outlook:2013:-:-:*:-:-:x86:*", "cpe:2.3:a:microsoft:outlook:2013:-:-:*:-:-:x64:*"], "platforms": ["32-bit Systems", "x64-based Systems"], "versions": [{"version": "14.0.0", "lessThan": "15.0.5571.1000", "versionType": "custom", "status": "affected"}]}, {"vendor": "Microsoft", "product": "Microsoft Outlook 2013 Service Pack 1", "cpes": ["cpe:2.3:a:microsoft:outlook:2013:*:*:*:rt:*:*:*"], "platforms": ["ARM64-based Systems"], "versions": [{"version": "15.0.0.0", "lessThan": "15.0.5571.1000", "versionType": "custom", "status": "affected"}]}], "descriptions": [{"value": "Microsoft Outlook Security Feature Bypass Vulnerability", "lang": "en-US"}], "problemTypes": [{"descriptions": [{"description": "CWE-367: Time-of-check Time-of-use (TOCTOU) Race Condition", "lang": "en-US", "type": "CWE", "cweId": "CWE-367"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2024-05-29T02:59:30.746Z"}, "references": [{"name": "Microsoft Outlook Security Feature Bypass Vulnerability", "tags": ["vendor-advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35311"}], "metrics": [{"format": "CVSS", "scenarios": [{"lang": "en-US", "value": "GENERAL"}], "cvssV3_1": {"version": "3.1", "baseSeverity": "HIGH", "baseScore": 8.8, "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C"}}]}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-02T16:23:59.684Z"}, "title": "CVE Program Container", "references": [{"name": "Microsoft Outlook Security Feature Bypass Vulnerability", "tags": ["vendor-advisory", "x_transferred"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35311"}]}]}}

{"cisaActionDue": "2023-08-01", "cisaExploitAdd": "2023-07-11", "cisaRequiredAction": "Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.", "cisaVulnerabilityName": "Microsoft Outlook Security Feature Bypass Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*", "matchCriteriaId": "40C15EDD-98D4-4D06-BA06-21AE0F33C72D", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*", "matchCriteriaId": "FF177984-A906-43FA-BF60-298133FBBD6B", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2021:*:*:*:ltsc:*:*:*", "matchCriteriaId": "25D63F31-2978-4C24-B7CA-6A0398012700", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:2013:-:-:*:-:-:*:*", "matchCriteriaId": "77F369D5-6771-4141-A116-50FB275A937A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*", "matchCriteriaId": "DDA98A76-D0D1-4BFA-BEAC-1C2313F7B859", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*", "matchCriteriaId": "E2B1657C-0FF4-461A-BE2A-641275C4B0A0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Outlook Security Feature Bypass Vulnerability"}], "id": "CVE-2023-35311", "lastModified": "2024-11-21T08:08:10.387", "metrics": {"cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "[email protected]", "type": "Secondary"}, {"cvssData": {"attackComplexity": "HIGH", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 7.5, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.6, "impactScore": 5.9, "source": "[email protected]", "type": "Primary"}]}, "published": "2023-07-11T18:15:17.177", "references": [{"source": "[email protected]", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35311"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-35311"}], "sourceIdentifier": "[email protected]", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-367"}], "source": "[email protected]", "type": "Secondary"}, {"description": [{"lang": "en", "value": "CWE-367"}], "source": "[email protected]", "type": "Primary"}]}