certfr_alerte - certfr-2023-ale-006

CERTFR-2023-ALE-006

Vulnerability from certfr_alerte

Description de la vulnérabilité

Dans le cadre de son Patch Tuesday, en date du 11 juillet 2023, Microsoft a indiqué l'existence d'une vulnérabilité référencée CVE-2023-36884 [1] au sein de plusieurs versions de Windows et produits Office. Un score CVSSv3 de 8.3 lui a été attribué.

L'éditeur confirme qu'elle est activement exploitée de façon ciblée [2].

La vulnérabilité CVE-2023-36884 permet à un attaquant d'exécuter du code arbitraire à distance dans le contexte utilisateur à l'aide d'un document Microsoft Office spécialement conçu, préalablement transmis à l'aide de technique d'ingénierie sociale.

Le CERT-FR recommande fortement de mettre en œuvre les moyens d'atténuation proposés par l'éditeur en attendant la publication d'un correctif.

Cette alerte sera mise à jour de façon régulière au gré des nouveaux éléments qui nous seront communiqués.

Campagne d'exploitation

La CVE-2023-36884 aurait été exploitée, d’après Microsoft [4], par le mode opératoire Storm-0978 lors d’une campagne en juin 2023 contre des entités gouvernementales et du secteur de la défense européennes et nord-américaines à des fins d’espionnage. Le code malveillant utilisé par les attaquants suite à l’exploitation de cette vulnérabilité, présenterait des similarités avec la porte dérobée RomCom.

RomCom est un code malveillant découvert en août 2022 par PaloAlto [5], qui aurait été utilisé depuis octobre 2022 dans des campagnes d’espionnage contre des entités gouvernementales et militaires ukrainiennes ([6], [7]), et des entités des secteurs du gouvernement, de la défense, de la santé, des services numériques et de la logistique dans certains pays d’Europe et d’Amérique du Nord ([7], [8], [9], [10], [11], [4]).

Le code malveillant RomCom a été associé au groupe cybercriminel Cuba par plusieurs éditeurs de sécurité [5], [12]. Cuba est notamment connu pour avoir revendiqué l’attaque par rançongiciel contre le gouvernement du Monténégro en août 2022 [13].

Contournement provisoire

L'éditeur fournit un ensemble de mesures d’atténuation visant à limiter son exploitation. [1] [3]

Solution

Les mises à jour publiées par l'éditeur en août 2023 corrigent cette vulnérabilité [1].

Impacted products

Vendor	Product	Description
Microsoft	Office	Microsoft Office LTSC 2021 pour éditions 32 bits
Microsoft	Office	Microsoft Office 2019 pour éditions 32 bits
Microsoft	Office	Microsoft Office 2019 pour éditions 64 bits
Microsoft	Office	Microsoft Office LTSC 2021 pour éditions 64 bits
Microsoft	N/A	Microsoft Word 2016 (édition 64 bits)
Microsoft	N/A	Microsoft Word 2013 Service Pack 1 (éditions 64 bits)
Microsoft	N/A	Microsoft Word 2013 Service Pack 1 (éditions 32 bits)
Microsoft	N/A	Microsoft Word 2016 (édition 32 bits)
Microsoft	Windows	Windows Server 2008 pour systèmes x64 Service Pack 2
Microsoft	Windows	Windows 10 Version 21H2 pour systèmes x64
Microsoft	Windows	Windows 10 Version 1809 pour systèmes 32 bits
Microsoft	Windows	Windows 10 Version 22H2 pour systèmes ARM64
Microsoft	Windows	Windows Server 2008 pour systèmes 32 bits Service Pack 2
Microsoft	Windows	Windows 10 Version 22H2 pour systèmes x64
Microsoft	Windows	Windows 10 Version 1607 pour systèmes x64
Microsoft	Windows	Windows 11 version 21H2 pour systèmes x64
Microsoft	Windows	Windows Server 2016 (Server Core installation)
Microsoft	Windows	Windows Server 2022 (Server Core installation)
Microsoft	Windows	Windows Server 2008 R2 pour systèmes x64 Service Pack 1 (Server Core installation)
Microsoft	Windows	Windows 10 pour systèmes 32 bits
Microsoft	Windows	Windows 10 Version 1809 pour systèmes ARM64
Microsoft	Windows	Windows Server 2008 pour systèmes x64 Service Pack 2 (Server Core installation)
Microsoft	Windows	Windows 10 Version 21H2 pour systèmes ARM64
Microsoft	Windows	Windows Server 2019
Microsoft	Windows	Windows Server 2019 (Server Core installation)
Microsoft	Windows	Windows Server 2008 pour systèmes 32 bits Service Pack 2 (Server Core installation)
Microsoft	Windows	Windows Server 2008 R2 pour systèmes x64 Service Pack 1
Microsoft	Windows	Windows 10 Version 21H2 pour systèmes 32 bits
Microsoft	Windows	Windows Server 2012 R2 (Server Core installation)
Microsoft	Windows	Windows 10 pour systèmes x64
Microsoft	Windows	Windows Server 2012
Microsoft	Windows	Windows 10 Version 22H2 pour systèmes 32 bits
Microsoft	Windows	Windows Server 2016
Microsoft	Windows	Windows Server 2012 R2
Microsoft	Windows	Windows 10 Version 1809 pour systèmes x64
Microsoft	Windows	Windows Server 2022
Microsoft	Windows	Windows 11 Version 22H2 pour systèmes x64
Microsoft	Windows	Windows 10 Version 1607 pour systèmes 32 bits
Microsoft	Windows	Windows Server 2012 (Server Core installation)
Microsoft	Windows	Windows 11 version 21H2 pour systèmes ARM64
Microsoft	Windows	Windows 11 Version 22H2 pour systèmes ARM64

References

Title

Publication Time

Tags

[13]	-	other
[7]	-	other
[9]	-	other
[2]	-	other
[8]	-	other
[10]	-	other
[12]	-	other
[4]	-	other
[11]	-	other
[6]	-	other
[1]	-	other
[5]	-	other
[3]	-	other

Show details on source website

JSON

To clipboard

{
  "$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
  "affected_systems": [
    {
      "description": "Microsoft Office LTSC 2021 pour \u00e9ditions 32 bits",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office 2019 pour \u00e9ditions 32 bits",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office 2019 pour \u00e9ditions 64 bits",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Office LTSC 2021 pour \u00e9ditions 64 bits",
      "product": {
        "name": "Office",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2016 (\u00e9dition 64 bits)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2013 Service Pack 1 (\u00e9ditions 64 bits)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2013 Service Pack 1 (\u00e9ditions 32 bits)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Microsoft Word 2016 (\u00e9dition 32 bits)",
      "product": {
        "name": "N/A",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 22H2 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 22H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 11 version 21H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes x64 Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H2 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2019 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 pour syst\u00e8mes 32 bits Service Pack 2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2008 R2 pour syst\u00e8mes x64 Service Pack 1",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 21H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 22H2 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2016",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 R2",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1809 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2022",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 11 Version 22H2 pour syst\u00e8mes x64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 10 Version 1607 pour syst\u00e8mes 32 bits",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows Server 2012 (Server Core installation)",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 11 version 21H2 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    },
    {
      "description": "Windows 11 Version 22H2 pour syst\u00e8mes ARM64",
      "product": {
        "name": "Windows",
        "vendor": {
          "name": "Microsoft",
          "scada": false
        }
      }
    }
  ],
  "affected_systems_content": "",
  "closed_at": "2023-12-12",
  "content": "## Contournement provisoire\n\nL\u0027\u00e9diteur fournit un ensemble de mesures d\u2019att\u00e9nuation visant \u00e0 limiter\nson exploitation. \\[1\\] \\[3\\]\n\n## Solution\n\nLes mises \u00e0 jour publi\u00e9es par l\u0027\u00e9diteur en ao\u00fbt 2023 corrigent cette\nvuln\u00e9rabilit\u00e9 \\[1\\].\n",
  "cves": [
    {
      "name": "CVE-2023-36884",
      "url": "https://www.cve.org/CVERecord?id=CVE-2023-36884"
    }
  ],
  "initial_release_date": "2023-12-12T00:00:00",
  "last_revision_date": "2023-12-12T00:00:00",
  "links": [
    {
      "title": "[13]",
      "url": "https://www.bankinfosecurity.com/cuba-ransomware-gang-takes-credit-for-attacking-montenegro-a-19938"
    },
    {
      "title": "[7]",
      "url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
    },
    {
      "title": "[9]",
      "url": "https://blogs.blackberry.com/en/2023/06/romcom-resurfaces-targeting-ukraine"
    },
    {
      "title": "[2]",
      "url": "https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/"
    },
    {
      "title": "[8]",
      "url": "https://www.trendmicro.com/en_us/research/23/e/void-rabisu-s-use-of-romcom-backdoor-shows-a-growing-shift-in-th.html"
    },
    {
      "title": "[10]",
      "url": "https://blogs.blackberry.com/en/2023/07/romcom-targets-ukraine-nato-membership-talks-at-nato-summit"
    },
    {
      "title": "[12]",
      "url": "https://blog.google/threat-analysis-group/ukraine-remains-russias-biggest-cyber-focus-in-2023/"
    },
    {
      "title": "[4]",
      "url": "https://www.microsoft.com/en-us/security/blog/2023/07/11/storm-0978-attacks-reveal-financial-and-espionage-motives/"
    },
    {
      "title": "[11]",
      "url": "https://cert.gov.ua/article/5077168"
    },
    {
      "title": "[6]",
      "url": "https://cert.gov.ua/article/2394117"
    },
    {
      "title": "[1]",
      "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884"
    },
    {
      "title": "[5]",
      "url": "https://unit42.paloaltonetworks.com/cuba-ransomware-tropical-scorpius/"
    },
    {
      "title": "[3]",
      "url": "https://learn.microsoft.com/en-us/microsoft-365/security/defender-endpoint/attack-surface-reduction-rules-reference?view=o365-worldwide#block-all-office-applications-from-creating-child-processes"
    }
  ],
  "reference": "CERTFR-2023-ALE-006",
  "revisions": [
    {
      "description": "Correction de la rubrique SOLUTION",
      "revision_date": "2023-12-12T00:00:00.000000"
    },
    {
      "description": "Version initiale",
      "revision_date": "2023-07-12T00:00:00.000000"
    }
  ],
  "risks": [
    {
      "description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
    }
  ],
  "summary": "### Description de la vuln\u00e9rabilit\u00e9\n\nDans le cadre de son *Patch Tuesday*, en date du 11 juillet 2023,\nMicrosoft a indiqu\u00e9 l\u0027existence d\u0027une vuln\u00e9rabilit\u00e9 r\u00e9f\u00e9renc\u00e9e\nCVE-2023-36884 \\[1\\] au sein de plusieurs versions de Windows et\nproduits Office. Un score CVSSv3 de 8.3 lui a \u00e9t\u00e9 attribu\u00e9.\n\nL\u0027\u00e9diteur confirme qu\u0027elle est activement exploit\u00e9e de fa\u00e7on cibl\u00e9e\n\\[2\\].\n\nLa vuln\u00e9rabilit\u00e9 CVE-2023-36884 permet \u00e0 un attaquant d\u0027ex\u00e9cuter du code\narbitraire \u00e0 distance dans le contexte utilisateur \u00e0 l\u0027aide d\u0027un\ndocument Microsoft Office sp\u00e9cialement con\u00e7u, pr\u00e9alablement transmis \u00e0\nl\u0027aide de technique d\u0027ing\u00e9nierie sociale.\n\nLe CERT-FR recommande fortement de mettre en \u0153uvre les moyens\nd\u0027att\u00e9nuation propos\u00e9s par l\u0027\u00e9diteur en attendant la publication d\u0027un\ncorrectif.\n\nCette alerte sera mise \u00e0 jour de fa\u00e7on r\u00e9guli\u00e8re au gr\u00e9 des nouveaux\n\u00e9l\u00e9ments qui nous seront communiqu\u00e9s.\n\n\u00a0\n\n### Campagne d\u0027exploitation\n\nLa CVE-2023-36884 aurait \u00e9t\u00e9 exploit\u00e9e, d\u2019apr\u00e8s Microsoft \\[4\\], par le\nmode op\u00e9ratoire Storm-0978 lors d\u2019une campagne en juin 2023 contre des\nentit\u00e9s gouvernementales et du secteur de la d\u00e9fense europ\u00e9ennes et\nnord-am\u00e9ricaines \u00e0 des fins d\u2019espionnage. Le code malveillant utilis\u00e9\npar les attaquants suite \u00e0 l\u2019exploitation de cette vuln\u00e9rabilit\u00e9,\npr\u00e9senterait des similarit\u00e9s avec la porte d\u00e9rob\u00e9e RomCom.\n\nRomCom est un code malveillant d\u00e9couvert en ao\u00fbt 2022 par PaloAlto\n\\[5\\], qui aurait \u00e9t\u00e9 utilis\u00e9 depuis octobre 2022 dans des campagnes\nd\u2019espionnage contre des entit\u00e9s gouvernementales et militaires\nukrainiennes (\\[6\\], \\[7\\]), et des entit\u00e9s des secteurs du\ngouvernement, de la d\u00e9fense, de la sant\u00e9, des services num\u00e9riques et de\nla logistique dans certains pays d\u2019Europe et d\u2019Am\u00e9rique du Nord (\\[7\\],\n\\[8\\], \\[9\\], \\[10\\], \\[11\\], \\[4\\]).\n\nLe code malveillant RomCom a \u00e9t\u00e9 associ\u00e9 au groupe cybercriminel Cuba\npar plusieurs \u00e9diteurs de s\u00e9curit\u00e9 \\[5\\], \\[12\\]. Cuba est notamment\nconnu pour avoir revendiqu\u00e9 l\u2019attaque par ran\u00e7ongiciel contre le\ngouvernement du Mont\u00e9n\u00e9gro en ao\u00fbt 2022 \\[13\\].\n\n\u00a0\n",
  "title": "Vuln\u00e9rabilit\u00e9 dans les produits Microsoft",
  "vendor_advisories": []
}

CVE-2023-36884 (GCVE-0-2023-36884)

Vulnerability from cvelistv5

Published

2023-07-11 18:14

Modified

2025-10-21 23:05

Severity ?

7.5 (High) - CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C

CWE

CWE-362 - Concurrent Execution using Shared Resource with Improper Synchronization ('Race Condition')

Summary

Windows Search Remote Code Execution Vulnerability

References

URL

Tags

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884

vendor-advisory

Impacted products

Vendor

Product

Version

Microsoft

Windows 10 Version 1809

Version: 10.0.17763.0 < 10.0.17763.4737

Microsoft	Windows 10 Version 1809	Version: 10.0.0 < 10.0.17763.4737
Microsoft	Windows Server 2019	Version: 10.0.17763.0 < 10.0.17763.4737
Microsoft	Windows Server 2019 (Server Core installation)	Version: 10.0.17763.0 < 10.0.17763.4737
Microsoft	Windows Server 2022	Version: 10.0.20348.0 < 10.0.20348.1906
Microsoft	Windows 11 version 21H2	Version: 10.0.0 < 10.0.22000.2295
Microsoft	Windows 10 Version 21H2	Version: 10.0.19043.0 < 10.0.19044.3324
Microsoft	Windows 11 version 22H2	Version: 10.0.22621.0 < 10.0.22621.2134
Microsoft	Windows 10 Version 22H2	Version: 10.0.19045.0 < 10.0.19045.3324
Microsoft	Windows 10 Version 1507	Version: 10.0.10240.0 < 10.0.10240.20107
Microsoft	Windows 10 Version 1607	Version: 10.0.14393.0 < 10.0.14393.6167
Microsoft	Windows Server 2016	Version: 10.0.14393.0 < 10.0.14393.6167
Microsoft	Windows Server 2016 (Server Core installation)	Version: 10.0.14393.0 < 10.0.14393.6167
Microsoft	Windows Server 2008 Service Pack 2	Version: 6.0.6003.0 < 6.0.6003.22216
Microsoft	Windows Server 2008 Service Pack 2 (Server Core installation)	Version: 6.0.6003.0 < 6.0.6003.22216
Microsoft	Windows Server 2008 Service Pack 2	Version: 6.0.6003.0 < 6.0.6003.22216
Microsoft	Windows Server 2008 R2 Service Pack 1	Version: 6.1.7601.0 < 6.1.7601.26664
Microsoft	Windows Server 2008 R2 Service Pack 1 (Server Core installation)	Version: 6.1.7601.0 < 6.1.7601.26664
Microsoft	Windows Server 2012	Version: 6.2.9200.0 < 6.2.9200.24414
Microsoft	Windows Server 2012 (Server Core installation)	Version: 6.2.9200.0 < 6.2.9200.24414
Microsoft	Windows Server 2012 R2	Version: 6.3.9600.0 < 6.3.9600.21503
Microsoft	Windows Server 2012 R2 (Server Core installation)	Version: 6.3.9600.0 < 6.3.9600.21503

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-02T17:01:09.807Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "Office and Windows HTML Remote Code Execution Vulnerability",
            "tags": [
              "vendor-advisory",
              "x_transferred"
            ],
            "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884"
          },
          {
            "tags": [
              "x_transferred"
            ],
            "url": "http://seclists.org/fulldisclosure/2023/Jul/43"
          }
        ],
        "title": "CVE Program Container"
      },
      {
        "metrics": [
          {
            "other": {
              "content": {
                "id": "CVE-2023-36884",
                "options": [
                  {
                    "Exploitation": "active"
                  },
                  {
                    "Automatable": "no"
                  },
                  {
                    "Technical Impact": "total"
                  }
                ],
                "role": "CISA Coordinator",
                "timestamp": "2023-12-09T05:05:14.159170Z",
                "version": "2.0.3"
              },
              "type": "ssvc"
            }
          },
          {
            "other": {
              "content": {
                "dateAdded": "2023-07-17",
                "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36884"
              },
              "type": "kev"
            }
          }
        ],
        "providerMetadata": {
          "dateUpdated": "2025-10-21T23:05:43.124Z",
          "orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0",
          "shortName": "CISA-ADP"
        },
        "references": [
          {
            "tags": [
              "government-resource"
            ],
            "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-36884"
          }
        ],
        "timeline": [
          {
            "lang": "en",
            "time": "2023-07-17T00:00:00+00:00",
            "value": "CVE-2023-36884 added to CISA KEV"
          }
        ],
        "title": "CISA ADP Vulnrichment"
      }
    ],
    "cna": {
      "affected": [
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Windows 10 Version 1809",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.17763.4737",
              "status": "affected",
              "version": "10.0.17763.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "ARM64-based Systems"
          ],
          "product": "Windows 10 Version 1809",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.17763.4737",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2019",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.17763.4737",
              "status": "affected",
              "version": "10.0.17763.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2019 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.17763.4737",
              "status": "affected",
              "version": "10.0.17763.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2022",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.20348.1906",
              "status": "affected",
              "version": "10.0.20348.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems",
            "ARM64-based Systems"
          ],
          "product": "Windows 11 version 21H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.22000.2295",
              "status": "affected",
              "version": "10.0.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "ARM64-based Systems",
            "x64-based Systems"
          ],
          "product": "Windows 10 Version 21H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.19044.3324",
              "status": "affected",
              "version": "10.0.19043.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "ARM64-based Systems",
            "x64-based Systems"
          ],
          "product": "Windows 11 version 22H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.22621.2134",
              "status": "affected",
              "version": "10.0.22621.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems",
            "ARM64-based Systems",
            "32-bit Systems"
          ],
          "product": "Windows 10 Version 22H2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.19045.3324",
              "status": "affected",
              "version": "10.0.19045.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Windows 10 Version 1507",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.10240.20107",
              "status": "affected",
              "version": "10.0.10240.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Windows 10 Version 1607",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.14393.6167",
              "status": "affected",
              "version": "10.0.14393.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2016",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.14393.6167",
              "status": "affected",
              "version": "10.0.14393.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2016 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "10.0.14393.6167",
              "status": "affected",
              "version": "10.0.14393.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems"
          ],
          "product": "Windows Server 2008 Service Pack 2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.6003.22216",
              "status": "affected",
              "version": "6.0.6003.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "32-bit Systems",
            "x64-based Systems"
          ],
          "product": "Windows Server 2008 Service Pack 2 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.6003.22216",
              "status": "affected",
              "version": "6.0.6003.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2008  Service Pack 2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.0.6003.22216",
              "status": "affected",
              "version": "6.0.6003.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2008 R2 Service Pack 1",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.1.7601.26664",
              "status": "affected",
              "version": "6.1.7601.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2008 R2 Service Pack 1 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.1.7601.26664",
              "status": "affected",
              "version": "6.1.7601.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2012",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.2.9200.24414",
              "status": "affected",
              "version": "6.2.9200.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2012 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.2.9200.24414",
              "status": "affected",
              "version": "6.2.9200.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2012 R2",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.3.9600.21503",
              "status": "affected",
              "version": "6.3.9600.0",
              "versionType": "custom"
            }
          ]
        },
        {
          "platforms": [
            "x64-based Systems"
          ],
          "product": "Windows Server 2012 R2 (Server Core installation)",
          "vendor": "Microsoft",
          "versions": [
            {
              "lessThan": "6.3.9600.21503",
              "status": "affected",
              "version": "6.3.9600.0",
              "versionType": "custom"
            }
          ]
        }
      ],
      "cpeApplicability": [
        {
          "nodes": [
            {
              "cpeMatch": [
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:x86:*",
                  "versionEndExcluding": "10.0.17763.4737",
                  "versionStartIncluding": "10.0.17763.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_1809:*:*:*:*:*:*:arm64:*",
                  "versionEndExcluding": "10.0.17763.4737",
                  "versionStartIncluding": "10.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.17763.4737",
                  "versionStartIncluding": "10.0.17763.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2019:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.17763.4737",
                  "versionStartIncluding": "10.0.17763.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2022:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.20348.1906",
                  "versionStartIncluding": "10.0.20348.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_11_21H2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "10.0.22000.2295",
                  "versionStartIncluding": "10.0.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_21H2:*:*:*:*:*:*:x86:*",
                  "versionEndExcluding": "10.0.19044.3324",
                  "versionStartIncluding": "10.0.19043.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_11_22H2:*:*:*:*:*:*:arm64:*",
                  "versionEndExcluding": "10.0.22621.2134",
                  "versionStartIncluding": "10.0.22621.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_22H2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "10.0.19045.3324",
                  "versionStartIncluding": "10.0.19045.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_1507:*:*:*:*:*:*:x86:*",
                  "versionEndExcluding": "10.0.10240.20107",
                  "versionStartIncluding": "10.0.10240.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_10_1607:*:*:*:*:*:*:x86:*",
                  "versionEndExcluding": "10.0.14393.6167",
                  "versionStartIncluding": "10.0.14393.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.14393.6167",
                  "versionStartIncluding": "10.0.14393.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
                  "versionEndExcluding": "10.0.14393.6167",
                  "versionStartIncluding": "10.0.14393.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.0.6003.22216",
                  "versionStartIncluding": "6.0.6003.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.0.6003.22216",
                  "versionStartIncluding": "6.0.6003.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2008_sp2:*:*:*:*:*:*:x86:*",
                  "versionEndExcluding": "6.0.6003.22216",
                  "versionStartIncluding": "6.0.6003.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.1.7601.26664",
                  "versionStartIncluding": "6.1.7601.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2008_R2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.1.7601.26664",
                  "versionStartIncluding": "6.1.7601.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.2.9200.24414",
                  "versionStartIncluding": "6.2.9200.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2012:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.2.9200.24414",
                  "versionStartIncluding": "6.2.9200.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.3.9600.21503",
                  "versionStartIncluding": "6.3.9600.0",
                  "vulnerable": true
                },
                {
                  "criteria": "cpe:2.3:o:microsoft:windows_server_2012_R2:*:*:*:*:*:*:x64:*",
                  "versionEndExcluding": "6.3.9600.21503",
                  "versionStartIncluding": "6.3.9600.0",
                  "vulnerable": true
                }
              ],
              "negate": false,
              "operator": "OR"
            }
          ]
        }
      ],
      "datePublic": "2023-07-11T07:00:00.000Z",
      "descriptions": [
        {
          "lang": "en-US",
          "value": "Windows Search Remote Code Execution Vulnerability"
        }
      ],
      "metrics": [
        {
          "cvssV3_1": {
            "baseScore": 7.5,
            "baseSeverity": "HIGH",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C",
            "version": "3.1"
          },
          "format": "CVSS",
          "scenarios": [
            {
              "lang": "en-US",
              "value": "GENERAL"
            }
          ]
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "cweId": "CWE-362",
              "description": "CWE-362: Concurrent Execution using Shared Resource with Improper Synchronization (\u0027Race Condition\u0027)",
              "lang": "en-US",
              "type": "CWE"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2025-01-01T01:59:03.473Z",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "Windows Search Remote Code Execution Vulnerability",
          "tags": [
            "vendor-advisory"
          ],
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36884"
        }
      ],
      "title": "Windows Search Remote Code Execution Vulnerability"
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2023-36884",
    "datePublished": "2023-07-11T18:14:23.245Z",
    "dateReserved": "2023-06-27T20:28:05.993Z",
    "dateUpdated": "2025-10-21T23:05:43.124Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Published Proof of Concept: A public proof of concept is available for this vulnerability.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted

CERTFR-2023-ALE-006

Vulnerability from certfr_alerte

Description de la vulnérabilité

Campagne d'exploitation

Contournement provisoire

Solution

CVE-2023-36884 (GCVE-0-2023-36884)

Vulnerability from cvelistv5

Tags

Sightings

Nomenclature