Threat Advisory: Microsoft Outlook privilege escalation vulnerability being exploited in the wild
Summary: Cisco Talos urged all users to update Microsoft Outlook after the discovery of CVE-2023-23397, a critical privilege escalation vulnerability in the Windows email client that attackers were actively exploiting in the wild, with Microsoft releasing a patch on Tuesday as part of its monthly security update. Microsoft assessed the limited, targeted attacks against a small number of organizations as associated with Russian-based actors, and the vulnerability was first reported to Microsoft by the Computer Emergency Response Team of Ukraine.
What's compelling: An attacker triggers this by sending a specially crafted email, calendar invite or task containing a PidLidReminderFileParameter property pointing to an attacker-controlled SMB share, causing the victim's Net-NTLMv2 hash to be sent out and usable in NTLM Relay attacks - and Microsoft says exploitation can occur before the email is viewed in the Preview Pane. Kenna Security scored it 74 out of 100, higher than 99 percent of all vulnerabilities it has scored, with the score expected to rise once proof-of-concept exploit code becomes available.
Read the original at Cisco Talos ↗
- Topics
- Vulnerabilities & Patching
- Mentions
- CVE-2023-23397
- Related
- CVE-2023-23397: Microsoft Office Outlook Privilege Escalation Vulnerability Known Exploited Vulnerabilities · Mar 14, 2023Microsoft Patch Tuesday, March 2023 Edition Cyber Risks ·