⚠ Actively exploited
Added to CISA KEV on 2023-07-11. Federal agencies required to patch by 2023-08-01. Required action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable..

CVE-2023-35311

CWE-3678 documents7 sources
Severity
7.5HIGH
EPSS
0.5%
top 35.21%
CISA KEV
KEV
Added 2023-07-11
Due 2023-08-01
Exploit
Exploited in wild
Active exploitation observed
Affected products
9
Microsoft Microsoft 365 Apps FOR EnterpriseMicrosoft Microsoft Office 2019Microsoft Microsoft Office Ltsc 2021+6 more
Timeline
PublishedJul 11
KEV addedJul 11
KEV dueAug 1
CISA Required Action: Apply updates per vendor instructions or discontinue use of the product if updates are unavailable.

Description

Microsoft Outlook Security Feature Bypass Vulnerability

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages9 packages

▶CVEListV5microsoft/microsoft_outlook_201314.0.0 — 15.0.5571.1000
▶CVEListV5microsoft/microsoft_outlook_201616.0.0.0 — 16.0.5404.1000
▶CVEListV5microsoft/microsoft_outlook_2013_service_pack_115.0.0.0 — 15.0.5571.1000
▶NVDmicrosoft/outlook2013, 2016+1
▶CVEListV5microsoft/microsoft_office_201919.0.0 — https://aka.ms/OfficeSecurityReleases

Patches

Patch: msrc.microsoft.com ↗Patch: msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-3w2f-j9r3-9h89: Microsoft Outlook Security Feature Bypass Vulnerability↗2023-07-11
▶
CVEList
Microsoft Outlook Security Feature Bypass Vulnerability↗2023-07-11
▶
VulnCheck
Microsoft Outlook Security Feature Bypass Vulnerability↗2023
▶

📋Vendor Advisories

2
Microsoft
Microsoft Outlook Security Feature Bypass Vulnerability↗2023-07-11
▶
CISA
Microsoft Outlook Security Feature Bypass Vulnerability↗2023-07-11
▶