Summary
Impact: Security Feature Bypass. Microsoft rating: Important. Not known to be exploited, publicly disclosed before the fix — Exploitation More Likely. Customer action: Required.
Details
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
An attacker must send the user a malicious file and convince them to open it.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
Successful exploitation of this vulnerability would allow an attacker to bypass the Office Protected View and open in editing mode rather than protected mode.
Security updates
https — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.0.5422.1000 — https://support.microsoft.com/help/5002521
Vulnerabilities 1
-
Medium 6.5CVE-2023-36413 EPSS 30%
Microsoft Office Security Feature Bypass Vulnerability
Microsoft Office Security Feature Bypass Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-36413 Microsoft Office Security Feature Bypass Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36413
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss