CVE-2023-29324
published 2023-05-09CVE-2023-29324: Windows MSHTML Platform Security Feature Bypass Vulnerability
PriorityP277medium6.5CVSS 3.1
AVNACLPRNUINSUCNILAL
ITWVulnCheck KEV
Exploited in the wild
EPSS
2.87%
86.7th percentile
Windows MSHTML Platform Security Feature Bypass Vulnerability
Affected
41 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10_1507 | < 10.0.10240.19926 | 10.0.10240.19926 |
| microsoft | windows_10_1607 | < 10.0.14393.5921 | 10.0.14393.5921 |
| microsoft | windows_10_1809 | < 10.0.17763.4377 | 10.0.17763.4377 |
| microsoft | windows_10_20h2 | < 10.0.19042.2965 | 10.0.19042.2965 |
| microsoft | windows_10_21h2 | < 10.0.19044.2965 | 10.0.19044.2965 |
| microsoft | windows_10_22h2 | < 10.0.19045.2965 | 10.0.19045.2965 |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < 10.0.10240.19926 | 10.0.10240.19926 |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < 10.0.14393.5921 | 10.0.14393.5921 |
| microsoft | windows_10_version_1809 | >= 10.0.0 < 10.0.17763.4377 | 10.0.17763.4377 |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < 10.0.17763.4377 | 10.0.17763.4377 |
| microsoft | windows_10_version_20h2 | >= 10.0.0 < 10.0.19042.2965 | 10.0.19042.2965 |
| microsoft | windows_10_version_21h2 | >= 10.0.19043.0 < 10.0.19044.2965 | 10.0.19044.2965 |
| microsoft | windows_10_version_22h2 | >= 10.0.19045.0 < 10.0.19045.2965 | 10.0.19045.2965 |
| microsoft | windows_11_21h2 | < 10.0.22000.1936 | 10.0.22000.1936 |
| microsoft | windows_11_22h2 | < 10.0.22000.1702 | 10.0.22000.1702 |
| microsoft | windows_11_version_21h2 | >= 10.0.0 < 10.0.22000.1936 | 10.0.22000.1936 |
| microsoft | windows_11_version_22h2 | >= 10.0.22621.0 < 10.0.22621.1702 | 10.0.22621.1702 |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < 6.1.7601.26519 | 6.1.7601.26519 |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < 6.0.6003.22070 | 6.0.6003.22070 |
| microsoft | windows_server_2012 | — | — |
| microsoft | windows_server_2012 | >= 6.2.9200.0 < 6.2.9200.24266 | 6.2.9200.24266 |
| microsoft | windows_server_2012_r2 | >= 6.3.9600.0 < 6.3.9600.20969 | 6.3.9600.20969 |
| microsoft | windows_server_2016 | >= 10.0.14393.0 < 10.0.14393.5921 | 10.0.14393.5921 |
| microsoft | windows_server_2019 | >= 10.0.17763.0 < 10.0.17763.4377 | 10.0.17763.4377 |
Detection & IOCsextracted from sources · hover to see the quote
- →CVE-2023-29324 is a bypass of the CVE-2023-23397 patch achieved by forging the malicious UNC path with a particular format; monitor Outlook MAPI extended properties (PidLidReminderFileParameter) for UNC paths containing unusual formatting such as appended '@80', '@SSL@443', or dotless hostnames that force WebDAV instead of SMB. ↗
- →Detect outbound SMB (port 445) connections from Outlook client processes to external/internet IP addresses, which indicates exploitation of CVE-2023-23397 / CVE-2023-29324 UNC path injection. ↗
- →Monitor for WebDAV connections from Outlook that use dotless hostnames or hostnames with '@' appended (e.g., hostname@80 or hostname@SSL@443), as these are bypass techniques to force WebDAV and exploit patched clients via CVE-2023-29324. ↗
- →Hunt for MSG, EML, or TNEF-format email attachments containing extended MAPI properties with UNC paths pointing to external IPs; the exploit does not require user interaction beyond receiving the message if the reminder is already expired. ↗
- →Block and alert on outbound connections to ports 135 and 445 from all inbound IP addresses as a mitigation/detection measure for CVE-2023-23397 and CVE-2023-29324 exploitation. ↗
- →Use Microsoft's published script to check Exchange users for targeting indicators; also monitor for unexpected Outlook mailbox permission changes which indicate post-exploitation lateral movement following credential theft. ↗
- ·The CVE-2023-23397 patch (and thus the CVE-2023-29324 bypass) only affects Microsoft Outlook for Windows; Outlook for Android, iOS, macOS, and Outlook on the web are NOT affected. ↗
- ·UNC paths pointing to INTRANET or TRUSTED local zones can still be abused even on a client patched for CVE-2023-23397, because MapUrlToZone() honors those zones; CVE-2023-29324 exploits this by crafting UNC paths that are misclassified as local/trusted. ↗
- ·WebDAV-based UNC paths do NOT leak Net-NTLMv2 hashes to external entities under normal conditions, but local WebDAV exploitability is possible on patched clients via CVE-2023-29324 using dotless hostnames or '@'-appended hostnames. ↗
CVSS provenance
nvdv3.16.5MEDIUMCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:L/A:L
vulncheck6.5MEDIUM
vendor_msrc6.5MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-xmv9-mx7p-4jr3: Windows MSHTML Platform Security Feature Bypass Vulnerability
ghsa_unreviewed·2023-05-09
CVE-2023-29324 [MEDIUM] GHSA-xmv9-mx7p-4jr3: Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
VulnCheck
Windows MSHTML Platform Security Feature Bypass
vulncheck·2023·CVSS 6.5
CVE-2023-29324 [MEDIUM] Windows MSHTML Platform Security Feature Bypass
Windows MSHTML Platform Security Feature Bypass
Windows MSHTML Platform Security Feature Bypass Vulnerability
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigations are unavailable.
Exploitation References: https://redsense.com/publications/yearly-intel-trend-review-2023/; https://go.catonetworks.com/rs/245-RJK-441/images/CATO-NETWORKS-THREAT-REPORT2024.pdf; https://go.catonetworks.com/rs/245-RJK-441/images/Q2_24_Cato_CTRL_Threat_Report.pdf; https://www.crowdstrike.com/explore/2025-global-threat-report
Microsoft
Windows MSHTML Platform Security Feature Bypass Vulnerability
vendor_msrc·2023-05-09·CVSS 6.5
CVE-2023-29324 [CRITICAL] CWE-73 Windows MSHTML Platform Security Feature Bypass Vulnerability
Windows MSHTML Platform Security Feature Bypass Vulnerability
FAQ: According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L) and some loss of availability (A:L). What does that mean for this vulnerability?
An attacker who successfully exploits the vulnerability could craft a malicious URL that would evade zone checks, resulting in a limited loss of integrity and availability on the victim machine.
FAQ: Are there additional steps that I need to take to be protected from this vulnerability?
Yes. Customers must install the updates for CVE-2023-23397 and CVE-2023-29324 to be fully protected. For more information, please see the MSRC Blog Post relating to CVE-2023-23397 here: Microsoft Mitigates Outlook Elevation of Privilege Vulner
No detection rules found.
No public exploits indexed.
Tenable
Microsoft’s May 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-30051, CVE-2024-30040)
blogs_tenable·2024-05-14·CVSS 8.8
[HIGH] Microsoft’s May 2024 Patch Tuesday Addresses 59 CVEs (CVE-2024-30051, CVE-2024-30040)
## Cloud Exposure
Tenable Cloud Security (CNAPP) Request a demo
Tenable Cloud Vulnerability Management Request a demo
Tenable CIEM Request a demo
Secure your cloud
## Vulnerability Exposure
Tenable Vulnerability Management Try for free
Tenable Security Center Request a demo
Tenable Web App Scanning Try for free
Tenable Patch Management Request a demo
Tenable Enclave Security Request a demo
Tenable Attack Surface Management Request a demo
Tenable Nessus Try for free
## AI Exposure
Tenable AI Exposure Request a demo
## OT/IoT Exposure
Tenable OT Security Request a demo
## Identity Exposure
Tenable Identity Exposure Request a demo
## Business needs
Active Directory
AI Security Posture Management (AI-SPM)
AWS security
Azure security
Cloud Security Posture Man
Bleepingcomputer
Russian military hackers target NATO fast reaction corps
blogs_bleepingcomputer·2023-12-07·CVSS 9.8
CVE-2023-23397 [CRITICAL] Russian military hackers target NATO fast reaction corps
## Russian military hackers target NATO fast reaction corps
## Sergiu Gatlan
Russian APT28 military hackers used Microsoft Outlook zero-day exploits to target multiple European NATO member countries, including a NATO Rapid Deployable Corps.
Researchers from Palo Alto Networks' Unit 42 have observed them exploiting the CVE-2023-23397 vulnerability over roughly 20 months in three campaigns against at least 30 organizations across 14 nations deemed of probable strategic intelligence significance to Russia's military and government.
The Russian hackers are also tracked as Fighting Ursa, Fancy Bear, and Sofacy, and they've been previously linked to Russia's Main Intelligence Directorate (GRU), the country's military intelligence service.
They started using the Outlook security flaw as a ze
Bleepingcomputer
Russian hackers exploiting Outlook bug to hijack Exchange accounts
blogs_bleepingcomputer·2023-12-04·CVSS 9.8
CVE-2023-23397 [CRITICAL] Russian hackers exploiting Outlook bug to hijack Exchange accounts
## Russian hackers exploiting Outlook bug to hijack Exchange accounts
## Bill Toulas
## Outlook flaw exploitation background
CVE-2023-23397 is a critical elevation of privilege (EoP) vulnerability in Outlook on Windows, which Microsoft fixed as a zero-day on the March 2023 Path Tuesday .
The disclosure of the flaw came with the revelation that APT28 had been exploiting it since April 2022 via specially crafted Outlook notes designed to steal NTLM hashes, forcing the target devices to authenticate to attacker-controlled SMB shares without requiring user interaction.
By elevating their privileges on the system, which was proven uncomplicated , APT28 performed lateral movement in the victim's environment and changed Outlook mailbox permissions to perform targeted email theft.
Despite th
Securelist
Kaspersky malware report for Q3 2023
blogs_securelist·2023-12-01·CVSS 9.8
[CRITICAL] Kaspersky malware report for Q3 2023
Table of Contents
- Targeted attacks
- Other malware
Authors
- David Emm
- IT threat evolution in Q3 2023
- IT threat evolution in Q3 2023. Non-mobile statistics
- IT threat evolution in Q3 2023. Mobile statistics
## Targeted attacks
### Unknown threat actor targets power generator with DroxiDat and Cobalt Strike
Earlier this year, we reported on a new variant of SystemBC called DroxiDat that was deployed against a critical infrastructure target in South Africa. This proxy-capable backdoor was deployed alongside Cobalt Strike beacons.
The incident occurred in the third and fourth week of March, as part of a small wave of attacks involving both DroxiDat and Cobalt Strike beacons around the world; and we believe this incident may have been the initial stage of a ransomware attack.
D
Securelist
IT threat evolution Q3 2023
blogs_securelist·2023-12-01·CVSS 9.8
CVE-2023-23397 [CRITICAL] IT threat evolution Q3 2023
Table of Contents
Targeted attacks
Unknown threat actor targets power generator with DroxiDat and Cobalt Strike
Analysis of samples exploiting CVE-2023-23397 vulnerability
Common TTPs in attacks on industrial organizations
Evil Telegram doppelganger used to target people in China
Other malware
Possible supply-chain attack on Linux machines
The Cuba ransomware gang
Leaked Lockbit 3 builder
The evolving world of crimeware
A cryptor, a stealer and a banking Trojan
Authors
David Emm
IT threat evolution in Q3 2023
IT threat evolution in Q3 2023. Non-mobile statistics
IT threat evolution in Q3 2023. Mobile statistics
## Targeted attacks
## Unknown threat actor targets power generator with DroxiDat and Cobalt Strike
Earlier this year, we reported on a new variant of SystemBC ca
Securelist
Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
blogs_securelist·2023-07-19·CVSS 9.8
CVE-2023-23397 [CRITICAL] Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
Table of Contents
The CVE-2023-23397 vulnerability
The vulnerability fix
The WebDAV protocol
The samples
Sample list
Initial attack IOCs
Threat verification
A note about attacker infrastructure
Authors
Francesco Figurelli
Eduardo Ovalle
On March 14, 2023, Microsoft published a blogpost describing an Outlook Client Elevation of Privilege Vulnerability (CVSS: 9.8 CRITICAL). The publication generated a lot of activity among white, grey and black hat researchers, as well as lots of publications and tweets about the vulnerability and its exploitation. Below, we will highlight the key points and then focus on the initial use of this vulnerability by attackers before it became public.
Affected products include all supported versions of Microsoft Outlook for Windows. Other versions of
Securelist
Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
blogs_securelist·2023-07-19·CVSS 9.8
CVE-2023-23397 [CRITICAL] Comprehensive analysis of initial attack samples exploiting CVE-2023-23397 vulnerability
Table of Contents
- The CVE-2023-23397 vulnerability
- The samples
- Sample list
- Initial attack IOCs
- Threat verification
- A note about attacker infrastructure
Authors
- Francesco Figurelli
- Eduardo Ovalle
On March 14, 2023, Microsoft published a blogpost describing an Outlook Client Elevation of Privilege Vulnerability (CVSS: 9.8 CRITICAL). The publication generated a lot of activity among white, grey and black hat researchers, as well as lots of publications and tweets about the vulnerability and its exploitation. Below, we will highlight the key points and then focus on the initial use of this vulnerability by attackers before it became public.
Affected products include all supported versions of Microsoft Outlook for Windows. Other versions of Microsoft Outlook, such as those
Talos
Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three-plus years
blogs_talos·2023-05-09·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three-plus years
## Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three-plus years
Microsoft disclosed 40 vulnerabilities across its suite of products and software Tuesday, the fewest the company’s included in a Patch Tuesday since December 2019.
However, two of the vulnerabilities is being actively exploited in the wild, according to Microsoft, the fourth month in a row in which this is the case for the monthly roundup of security issues.
In all, this Patch Tuesday includes seven critical vulnerabilities and 33 that are considered “important.”
One of the zero-day vulnerabilities included this month is CVE-2023-29336 , an elevation of privilege vulnerability in the Win32k kernel mode driver. An adversary could exploit this vulnerability to gain SYSTEM privileges.
Qualys
Microsoft and Adobe Patch Tuesday, May 2023 Security Update Review
blogs_qualys·2023-05-09
Microsoft and Adobe Patch Tuesday, May 2023 Security Update Review
## Table of Contents
Microsoft Patch Tuesday for May 2023
Adobe Patches for May 2023
Zero-day Vulnerabilities Patched in May Patch Tuesday Edition
Other Critical Severity Vulnerabilities Patched in May Patch Tuesday Edition
Other Microsoft Vulnerability Highlights
Microsoft Release Summary
Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
Rapid Response with Patch Management (PM)
EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
Qualys Monthly Webinar Series
This Month in Vulnerabilities & Patches
Microsoft has addressed 49 vulnerabilities in its May Patch Tuesday edition. The security advisories cover various vulnerabilities in different produc
Talos
Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three-plus years
blogs_talos·2023-05-09·CVSS 9.8
[CRITICAL] Microsoft Patch Tuesday for May 2023 — Fewest vulnerabilities disclosed in a month in three-plus years
Microsoft disclosed 40 vulnerabilities across its suite of products and software Tuesday, the fewest the company’s included in a Patch Tuesday since December 2019.
However, two of the vulnerabilities is being actively exploited in the wild, according to Microsoft, the fourth month in a row in which this is the case for the monthly roundup of security issues.
In all, this Patch Tuesday includes seven critical vulnerabilities and 33 that are considered “important.”
One of the zero-day vulnerabilities included this month is CVE-2023-29336, an elevation of privilege vulnerability in the Win32k kernel mode driver. An adversary could exploit this vulnerability to gain SYSTEM privileges.
The most serious vulnerability disclosed Tuesday is CVE-2023-24941, a remote code execution vulnerability
Qualys
Microsoft Patch Tuesday, May 2023 Security Update Review | Qualys
blogs_qualys·2023-05-09
Microsoft Patch Tuesday, May 2023 Security Update Review | Qualys
#### Table of Contents
- Microsoft Patch Tuesday for May 2023
- Adobe Patches for May 2023
- Zero-day Vulnerabilities Patched in May Patch Tuesday Edition
- Other Critical Severity Vulnerabilities Patched in May Patch Tuesday Edition
- Other Microsoft Vulnerability Highlights
- Microsoft Release Summary
- Discover and Prioritize Vulnerabilities in Vulnerability Management, Detection & Response (VMDR)
- Rapid Response with Patch Management (PM)
- EVALUATE Vendor-Suggested Mitigation with Policy Compliance (PC)
- EXECUTE Mitigation Using Qualys Custom Assessment and Remediation (CAR)
- Qualys Monthly Webinar Series
- This Month in Vulnerabilities & Patches
Microsoft has addressed 49 vulnerabilities in its May Patch Tuesday edition. The security advisories cover various vulnerabilities in d
Crowdstrike
May 2023 Patch Tuesday: Updates and Analysis
blogs_crowdstrike·CVSS 7.5
CVE-2026-20929 [HIGH] May 2023 Patch Tuesday: Updates and Analysis
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
STARDUST CHOLLIMA Likely Compromises Axios npm Package Apr 01, 2026
Falcon for IT Supports Windows Secure Boot Certificate Lifecycle Management Apr 01, 2026
Detecting CVE-2026-20929: Kerberos Authentication Relay via CNAME Abuse Mar 31, 2026
How Charlotte AI AgentWorks Fuels Security's Agentic Ecosystem Mar 25, 2026
Video Highlights the 4 Key Steps to Successful Incident Response Dec 02, 2019
Helping Non-Security Stakeholders Understand ATT&CK in 10 Minutes or Less [VI
2023-05-09
Published
Exploited in the wild