Summary
Impact: Spoofing. Microsoft rating: Important. Not known to be exploited — Exploitation Less Likely. Customer action: Required.
Details
What type of information could be disclosed by this vulnerability?
Exploiting this vulnerability could allow the disclosure of NetNTLMv2 hashes.
Is the Preview Pane an attack vector for this vulnerability?
No, the Preview Pane is not an attack vector.
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
This vulnerability requires that a user with an affected version of Outlook open a malicious meeting or appointment invite from the attacker.
Security updates
https — https://docs.microsoft.com/en-us/officeupdates/microsoft365-apps-security-updates
16.0.5408.1000 — https://support.microsoft.com/help/5002459
15.0.5579.1000 — https://support.microsoft.com/help/5002449
Vulnerabilities 1
-
Medium 6.5
Microsoft Outlook Spoofing Vulnerability
Microsoft Outlook Spoofing Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-36893 Microsoft Outlook Spoofing Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36893
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss