Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The attacker would be able to bypass the protection in Outlook that prevents an image from being shown automatically in an email. Depending on the user's settings, the user would normally need to choose to download images for display. If an attacker successfully exploited this vulnerability it could expose the target's IP information.
How do I get the update for Outlook for Mac?
Tap the Settings Icon
Tap the iTunes & App Store
Turn on AUTOMATIC DOWNLOADS for Apps
Tap the App Store Icon
Scroll down to find Microsoft Outlook
Tap the Update button
If the preview pane is an attack vector, why is the severity for this vulnerability Important and not Critical?
Even though the preview pane is an attack vector, the attacker cannot achieve remote code execution if they successfully exploit the vulnerability, but can only gain information from the victim.
Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
Security updates
16.57 — https://apps.apple.com/us/app/microsoft-outlook/id985367838?mt=12
Vulnerabilities 1
-
Medium 5.3
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
Microsoft Outlook for Mac Security Feature Bypass Vulnerability
Revision history
-
#2
Updated acknowledgment. This is an informational change only.
-
#1
Information published.
References
-
CVE-2022-23280 Microsoft Outlook for Mac Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23280
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss