Vulnerability-Lookup

WID-SEC-W-2023-2608

Vulnerability from csaf_certbund - Published: 2023-10-10 22:00 - Updated: 2023-10-10 22:00

Summary

Microsoft Office: Mehrere Schwachstellen

Severity

Hoch

Notes

Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.

Produktbeschreibung: Microsoft 365 Apps ist eine Office Suite für zahlreiche Büroanwendungen. Die Microsoft Office Suite beinhaltet zahlreiche Büroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen. Skype ist ein Instant-Messaging-Dienst. Unterstützt werden Videokonferenzen, IP-Telefonie, Instant-Messaging, Dateiübertragung und Screen-Sharing.

Angriff: Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Office ausnutzen, um seine Privilegien zu erhöhen und beliebigen Code auszuführen.

Betroffene Betriebssysteme: - Windows

CVE-2023-41763

Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchführung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse auslösen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuführen. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erhöhte Rechte.

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36789

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36786

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36780

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36569

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36568

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

CVE-2023-36565

Affected products

Known affected 9 products

Product	Identifier	Version
Microsoft Skype for Business Server 2015 CU13 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2015_cu13`	—
Microsoft Office for Android Microsoft / Office	`cpe:/a:microsoft:office:for_android`	—
Microsoft Skype for Business Server 2019 CU7 Microsoft / Skype	`cpe:/a:microsoft:skype:for_business_server_2019_cu7`	—
Microsoft Office LTSC for Mac 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_for_mac_2021`	—
Microsoft Office 2019 for Mac Microsoft	`cpe:/a:microsoft:office_2019_for_mac:-`	—
Microsoft 365 Apps Microsoft	`cpe:/a:microsoft:365_apps:-`	—
Microsoft Office 2019 Microsoft	`cpe:/a:microsoft:office_2019:-`	—
Microsoft Office for Universal Microsoft / Office	`cpe:/a:microsoft:office:for_universal`	—
Microsoft Office LTSC 2021 Microsoft / Office	`cpe:/a:microsoft:office:ltsc_2021`	—

References

3 references

URL	Category
https://wid.cert-bund.de/.well-known/csaf/white/2…	self
https://wid.cert-bund.de/portal/wid/securityadvis…	self
https://msrc.microsoft.com/update-guide	external

JSON

To clipboard

{
  "document": {
    "aggregate_severity": {
      "text": "hoch"
    },
    "category": "csaf_base",
    "csaf_version": "2.0",
    "distribution": {
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "de-DE",
    "notes": [
      {
        "category": "legal_disclaimer",
        "text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
      },
      {
        "category": "description",
        "text": "Microsoft 365 Apps ist eine Office Suite f\u00fcr zahlreiche B\u00fcroanwendungen.\r\nDie Microsoft Office Suite beinhaltet zahlreiche B\u00fcroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.\r\nSkype ist ein Instant-Messaging-Dienst. Unterst\u00fctzt werden Videokonferenzen, IP-Telefonie, Instant-Messaging, Datei\u00fcbertragung und Screen-Sharing.",
        "title": "Produktbeschreibung"
      },
      {
        "category": "summary",
        "text": "Ein entfernter, anonymer, authentisierter oder lokaler Angreifer kann mehrere Schwachstellen in Microsoft Office ausnutzen, um seine Privilegien zu erh\u00f6hen und beliebigen Code auszuf\u00fchren.",
        "title": "Angriff"
      },
      {
        "category": "general",
        "text": "- Windows",
        "title": "Betroffene Betriebssysteme"
      }
    ],
    "publisher": {
      "category": "other",
      "contact_details": "csaf-provider@cert-bund.de",
      "name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
      "namespace": "https://www.bsi.bund.de"
    },
    "references": [
      {
        "category": "self",
        "summary": "WID-SEC-W-2023-2608 - CSAF Version",
        "url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-2608.json"
      },
      {
        "category": "self",
        "summary": "WID-SEC-2023-2608 - Portal Version",
        "url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-2608"
      },
      {
        "category": "external",
        "summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-10-10",
        "url": "https://msrc.microsoft.com/update-guide"
      }
    ],
    "source_lang": "en-US",
    "title": "Microsoft Office: Mehrere Schwachstellen",
    "tracking": {
      "current_release_date": "2023-10-10T22:00:00.000+00:00",
      "generator": {
        "date": "2024-08-15T17:59:39.815+00:00",
        "engine": {
          "name": "BSI-WID",
          "version": "1.3.5"
        }
      },
      "id": "WID-SEC-W-2023-2608",
      "initial_release_date": "2023-10-10T22:00:00.000+00:00",
      "revision_history": [
        {
          "date": "2023-10-10T22:00:00.000+00:00",
          "number": "1",
          "summary": "Initiale Fassung"
        }
      ],
      "status": "final",
      "version": "1"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_name",
            "name": "Microsoft 365 Apps",
            "product": {
              "name": "Microsoft 365 Apps",
              "product_id": "T016910",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:365_apps:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Microsoft Office LTSC for Mac 2021",
                "product": {
                  "name": "Microsoft Office LTSC for Mac 2021",
                  "product_id": "T020985",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:ltsc_for_mac_2021"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office for Android",
                "product": {
                  "name": "Microsoft Office for Android",
                  "product_id": "T026296",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:for_android"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office for Universal",
                "product": {
                  "name": "Microsoft Office for Universal",
                  "product_id": "T026297",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:for_universal"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Office LTSC 2021",
                "product": {
                  "name": "Microsoft Office LTSC 2021",
                  "product_id": "T029334",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:office:ltsc_2021"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Office"
          },
          {
            "category": "product_name",
            "name": "Microsoft Office 2019",
            "product": {
              "name": "Microsoft Office 2019",
              "product_id": "T014534",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:office_2019:-"
              }
            }
          },
          {
            "category": "product_name",
            "name": "Microsoft Office 2019 for Mac",
            "product": {
              "name": "Microsoft Office 2019 for Mac",
              "product_id": "T014533",
              "product_identification_helper": {
                "cpe": "cpe:/a:microsoft:office_2019_for_mac:-"
              }
            }
          },
          {
            "branches": [
              {
                "category": "product_name",
                "name": "Microsoft Skype for Business Server 2015 CU13",
                "product": {
                  "name": "Microsoft Skype for Business Server 2015 CU13",
                  "product_id": "T030376",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:skype:for_business_server_2015_cu13"
                  }
                }
              },
              {
                "category": "product_name",
                "name": "Microsoft Skype for Business Server 2019 CU7",
                "product": {
                  "name": "Microsoft Skype for Business Server 2019 CU7",
                  "product_id": "T030377",
                  "product_identification_helper": {
                    "cpe": "cpe:/a:microsoft:skype:for_business_server_2019_cu7"
                  }
                }
              }
            ],
            "category": "product_name",
            "name": "Skype"
          }
        ],
        "category": "vendor",
        "name": "Microsoft"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-41763",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-41763"
    },
    {
      "cve": "CVE-2023-36789",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36789"
    },
    {
      "cve": "CVE-2023-36786",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36786"
    },
    {
      "cve": "CVE-2023-36780",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36780"
    },
    {
      "cve": "CVE-2023-36569",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36569"
    },
    {
      "cve": "CVE-2023-36568",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36568"
    },
    {
      "cve": "CVE-2023-36565",
      "notes": [
        {
          "category": "description",
          "text": "Es existieren mehrere Schwachstellen in verschiedenen Microsoft Office Produkten. Die Fehler bestehen u.a. aufgrund einer Race Condition bei der Durchf\u00fchrung von Dateioperationen auf dem Rechner zu einem bestimmten Zeitpunkt, einem Netzwerkaufruf an den angreifenden Skype for Business Server, der das Parsen einer http-Anfrage an eine beliebige Adresse ausl\u00f6sen kann und einem Path-Traversal. Ein entfernter oder lokaler Angreifer kann diese Schwachstellen ausnutzen, um seine Privilegien zu erweitern und beliebigen Code auszuf\u00fchren. Das erfolgreiche Ausnutzen einiger dieser Schwachstellen erfordert erh\u00f6hte Rechte."
        }
      ],
      "product_status": {
        "known_affected": [
          "T030376",
          "T026296",
          "T030377",
          "T020985",
          "T014533",
          "T016910",
          "T014534",
          "T026297",
          "T029334"
        ]
      },
      "release_date": "2023-10-10T22:00:00.000+00:00",
      "title": "CVE-2023-36565"
    }
  ]
}

CVE-2023-36565 (GCVE-0-2023-36565)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:08 – Updated: 2025-04-14 22:46

Title

Microsoft Office Graphics Elevation of Privilege Vulnerability

Summary

Microsoft Office Graphics Elevation of Privilege Vulnerability

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-416 - Use After Free

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

4 products

Vendor	Product	Version
Microsoft	Microsoft Office 2019 for Mac	Affected: 16.0.0 , < 16.78.23100802 (custom)
Microsoft	Microsoft Office LTSC for Mac 2021	Affected: 16.0.1 , < 16.78.23100802 (custom)
Microsoft	Microsoft Office for Android	Affected: 16.0.1 , < 16.0.16827.20138 (custom)
Microsoft	Microsoft Office for Universal	Affected: 16.0.1 , < 16.0.14326.21606 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:52:53.365Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Microsoft Office Graphics Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36565"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36565",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T21:49:46.730820Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T20:42:12.762Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Office 2019 for Mac",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.78.23100802",
              "status": "affected",
              "version": "16.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Office LTSC for Mac 2021",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.78.23100802",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Office for Android",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.16827.20138",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Microsoft Office for Universal",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "16.0.14326.21606",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:office:*:*:*:*:*:macos:*:*",
                  "versionEndExcluding": "16.78.23100802",
                  "versionStartIncluding": "16.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:*:*:*:*:*:macos:*:*",
                  "versionEndExcluding": "16.78.23100802",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office:*:*:android:*:*:*:*:*",
                  "versionEndExcluding": "16.0.16827.20138",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office:*:*:universal:*:*:*:*:*",
                  "versionEndExcluding": "16.0.14326.21606",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Microsoft Office Graphics Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-416",
              "description": "CWE-416: Use After Free",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:46:46.280Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Office Graphics Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36565"
        }
      ],
      "title": "Microsoft Office Graphics Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36565",
    "datePublished": "2023-10-10T17:08:14.207Z",
    "dateReserved": "2023-06-23T20:11:38.790Z",
    "dateUpdated": "2025-04-14T22:46:46.280Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36568 (GCVE-0-2023-36568)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:07 – Updated: 2025-04-14 22:46

Title

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Summary

Microsoft Office Click-To-Run Elevation of Privilege Vulnerability

Severity

7 (High)


                        
                          CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-59 - Improper Link Resolution Before File Access ('Link Following')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Microsoft Office 2019	Affected: 19.0.0 , < https://aka.ms/OfficeSecurityReleases (custom)
Microsoft	Microsoft 365 Apps for Enterprise	Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)
Microsoft	Microsoft Office LTSC 2021	Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:52:53.636Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Microsoft Office Click-To-Run Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36568"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36568",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-26T21:49:52.794903Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-27T20:43:16.196Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office 2019",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "19.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft 365 Apps for Enterprise",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems",
            "32-bit Systems"
          ],
          "product": "Microsoft Office LTSC 2021",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "19.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Microsoft Office Click-To-Run Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-59",
              "description": "CWE-59: Improper Link Resolution Before File Access (\u0027Link Following\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:46:30.982Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Office Click-To-Run Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36568"
        }
      ],
      "title": "Microsoft Office Click-To-Run Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36568",
    "datePublished": "2023-10-10T17:07:59.738Z",
    "dateReserved": "2023-06-23T20:11:38.790Z",
    "dateUpdated": "2025-04-14T22:46:30.982Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36569 (GCVE-0-2023-36569)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:07 – Updated: 2025-04-14 22:46

Title

Microsoft Office Elevation of Privilege Vulnerability

Summary

Microsoft Office Elevation of Privilege Vulnerability

Severity

8.4 (High)


                        
                          CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

Elevation of Privilege

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

3 products

Vendor	Product	Version
Microsoft	Microsoft Office 2019	Affected: 19.0.0 , < https://aka.ms/OfficeSecurityReleases (custom)
Microsoft	Microsoft 365 Apps for Enterprise	Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)
Microsoft	Microsoft Office LTSC 2021	Affected: 16.0.1 , < https://aka.ms/OfficeSecurityReleases (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T16:52:53.453Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Microsoft Office Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36569"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36569",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2025-02-28T20:19:27.246206Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "problemTypes": [
          {
            "descriptions": [
              {
                "cweId": "CWE-269",
                "description": "CWE-269 Improper Privilege Management",
                "lang": "en",
                "type": "CWE"
              }
            ]
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-02-28T20:39:47.904Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft Office 2019",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "19.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Microsoft 365 Apps for Enterprise",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems",
            "32-bit Systems"
          ],
          "product": "Microsoft Office LTSC 2021",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "https://aka.ms/OfficeSecurityReleases",
              "status": "affected",
              "version": "16.0.1",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:office:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "19.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
                  "versionStartIncluding": "16.0.1",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Microsoft Office Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 8.4,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en-US",
              "type": "Impact"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:46:30.330Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Microsoft Office Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36569"
        }
      ],
      "title": "Microsoft Office Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36569",
    "datePublished": "2023-10-10T17:07:59.204Z",
    "dateReserved": "2023-06-23T20:11:38.790Z",
    "dateUpdated": "2025-04-14T22:46:30.330Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36780 (GCVE-0-2023-36780)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:08 – Updated: 2025-04-14 22:46

Title

Skype for Business Remote Code Execution Vulnerability

Summary

Skype for Business Remote Code Execution Vulnerability

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-426 - Untrusted Search Path

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Microsoft	Skype for Business Server 2019 CU7	Affected: 2046.0 , < 7.0.246.530 (custom)
Microsoft	Skype for Business Server 2015 CU13	Affected: 9319.0 , < 6.0.9319.869 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36780",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-10T13:26:32.285813Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-10T13:26:42.809Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.430Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Skype for Business Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2019 CU7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.246.530",
              "status": "affected",
              "version": "2046.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2015 CU13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.9319.869",
              "status": "affected",
              "version": "9319.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.246.530",
                  "versionStartIncluding": "2046.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.9319.869",
                  "versionStartIncluding": "9319.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Skype for Business Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-426",
              "description": "CWE-426: Untrusted Search Path",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:46:43.180Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Skype for Business Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36780"
        }
      ],
      "title": "Skype for Business Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36780",
    "datePublished": "2023-10-10T17:08:11.540Z",
    "dateReserved": "2023-06-27T15:11:59.870Z",
    "dateUpdated": "2025-04-14T22:46:43.180Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36786 (GCVE-0-2023-36786)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:08 – Updated: 2025-04-14 22:45

Title

Skype for Business Remote Code Execution Vulnerability

Summary

Skype for Business Remote Code Execution Vulnerability

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-36 - Absolute Path Traversal

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Microsoft	Skype for Business Server 2015 CU13	Affected: 9319.0 , < 6.0.9319.869 (custom)
Microsoft	Skype for Business Server 2019 CU7	Affected: 2046.0 , < 7.0.246.530 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36786",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-11T18:11:55.639582Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-11T18:12:20.273Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.532Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Skype for Business Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36786"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2015 CU13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.9319.869",
              "status": "affected",
              "version": "9319.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2019 CU7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.246.530",
              "status": "affected",
              "version": "2046.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.9319.869",
                  "versionStartIncluding": "9319.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.246.530",
                  "versionStartIncluding": "2046.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Skype for Business Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-36",
              "description": "CWE-36: Absolute Path Traversal",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:45:49.379Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Skype for Business Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36786"
        }
      ],
      "title": "Skype for Business Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36786",
    "datePublished": "2023-10-10T17:08:10.444Z",
    "dateReserved": "2023-06-27T15:11:59.871Z",
    "dateUpdated": "2025-04-14T22:45:49.379Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-36789 (GCVE-0-2023-36789)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:08 – Updated: 2025-04-14 22:45

Title

Skype for Business Remote Code Execution Vulnerability

Summary

Skype for Business Remote Code Execution Vulnerability

Severity

7.2 (High)


                        
                          CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C

CWE

CWE-94 - Improper Control of Generation of Code ('Code Injection')

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Microsoft	Skype for Business Server 2019 CU7	Affected: 2046.0 , < 7.0.246.530 (custom)
Microsoft	Skype for Business Server 2015 CU13	Affected: 9319.0 , < 6.0.9319.869 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36789",
                "options": [
                  {
                    "Exploitation": "none"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T01:03:26.133460Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2024-07-16T01:03:45.845Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.976Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Skype for Business Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36789"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2019 CU7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.246.530",
              "status": "affected",
              "version": "2046.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2015 CU13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.9319.869",
              "status": "affected",
              "version": "9319.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.246.530",
                  "versionStartIncluding": "2046.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.9319.869",
                  "versionStartIncluding": "9319.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Skype for Business Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.2,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-94",
              "description": "CWE-94: Improper Control of Generation of Code (\u0027Code Injection\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:45:50.074Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Skype for Business Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36789"
        }
      ],
      "title": "Skype for Business Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36789",
    "datePublished": "2023-10-10T17:08:09.912Z",
    "dateReserved": "2023-06-27T15:11:59.871Z",
    "dateUpdated": "2025-04-14T22:45:50.074Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

CVE-2023-41763 (GCVE-0-2023-41763)

Vulnerability from cvelistv5 – Published: 2023-10-10 17:07 – Updated: 2025-10-21 23:05

Title

Skype for Business Elevation of Privilege Vulnerability

Summary

Skype for Business Elevation of Privilege Vulnerability

Severity

5.3 (Medium)


                        
                          CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C

CWE

CWE-918 - Server-Side Request Forgery (SSRF)

Assigner

microsoft

References

1 reference

URL	Tags
https://msrc.microsoft.com/update-guide/vulnerabi…	vendor-advisory

Impacted products

2 products

Vendor	Product	Version
Microsoft	Skype for Business Server 2015 CU13	Affected: 9319.0 , < 6.0.9319.869 (custom)
Microsoft	Skype for Business Server 2019 CU7	Affected: 2046.0 , < 7.0.246.530 (custom)

Date Public

2023-10-10 07:00

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-41763",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "yes"
                  },
                  {
                    "Technical Impact": "partial"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2024-07-16T20:26:59.238274Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-10-10",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:34.874Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-41763"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-10-10T00:00:00.000Z",
            "value": "CVE-2023-41763 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      },
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T19:09:47.991Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Skype for Business Elevation of Privilege Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2015 CU13",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.9319.869",
              "status": "affected",
              "version": "9319.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "Unknown"
          ],
          "product": "Skype for Business Server 2019 CU7",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "7.0.246.530",
              "status": "affected",
              "version": "2046.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu13:*:*:*:*:*:*",
                  "versionEndExcluding": "6.0.9319.869",
                  "versionStartIncluding": "9319.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:a:microsoft:skype_for_business_server:*:cu7:*:*:*:*:*:*",
                  "versionEndExcluding": "7.0.246.530",
                  "versionStartIncluding": "2046.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-10-10T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Skype for Business Elevation of Privilege Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 5.3,
            "baseSeverity": "MEDIUM",
            "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-918",
              "description": "CWE-918: Server-Side Request Forgery (SSRF)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-04-14T22:45:50.701Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Skype for Business Elevation of Privilege Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41763"
        }
      ],
      "title": "Skype for Business Elevation of Privilege Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-41763",
    "datePublished": "2023-10-10T17:07:24.950Z",
    "dateReserved": "2023-08-31T23:08:32.064Z",
    "dateUpdated": "2025-10-21T23:05:34.874Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date	Other

Nomenclature

Seen: The vulnerability was mentioned, discussed, or observed by the user.
Confirmed: The vulnerability has been validated from an analyst's perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
Not confirmed: The user expressed doubt about the validity of the vulnerability.
Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.

Detection rules are retrieved from Rulezet.

Action not permitted

WID-SEC-W-2023-2608

CVE-2023-36565 (GCVE-0-2023-36565)

CVE-2023-36568 (GCVE-0-2023-36568)

CVE-2023-36569 (GCVE-0-2023-36569)

CVE-2023-36780 (GCVE-0-2023-36780)

CVE-2023-36786 (GCVE-0-2023-36786)

CVE-2023-36789 (GCVE-0-2023-36789)

CVE-2023-41763 (GCVE-0-2023-41763)

Tags

Sightings

Nomenclature