As a result, this could lead to exploitation without requiring any user interaction and before even the message is viewed in the Preview Pane.
The two vulnerabilities that have come under active attack include a Microsoft Outlook privilege escalation flaw ( CVE-2023-23397, CVSS score: 9.8) and a Windows SmartScreen security feature bypass ( CVE-2023-24880, CVSS score: 5.1).ĬVE-2023-23397 is "triggered when an attacker sends a message with an extended MAPI property with a UNC path to an SMB (TCP 445) share on a threat actor-controlled server," Microsoft said in a standalone advisory.Ī threat actor could leverage this flaw by sending a specially crafted email, activating it automatically when it is retrieved and processed by the Outlook client for Windows. The updates are in addition to 29 flaws the tech giant fixed in its Chromium-based Edge browser in recent weeks. Microsoft's Patch Tuesday update for March 2023 is rolling out with remediations for a set of 80 security flaws, two of which have come under active exploitation in the wild.Įight of the 80 bugs are rated Critical, 71 are rated Important, and one is rated Moderate in severity.
0 kommentar(er)
