Action not permitted
Modal body text goes here.
Modal Title
Modal Body
CVE-2023-21714 (GCVE-0-2023-21714)
Vulnerability from cvelistv5
Published
2023-02-14 19:33
Modified
2025-01-01 00:41
Severity ?
VLAI Severity ?
EPSS score ?
CWE
- CWE-125 - Out-of-bounds Read
Summary
Microsoft Office Information Disclosure Vulnerability
References
| URL | Tags | ||||||||||
|---|---|---|---|---|---|---|---|---|---|---|---|
|
|||||||||||
Impacted products
| Vendor | Product | Version | |||||||
|---|---|---|---|---|---|---|---|---|---|
| Microsoft | Microsoft 365 Apps for Enterprise |
Version: 16.0.1 < https://aka.ms/OfficeSecurityReleases |
|||||||
|
|||||||||
{
"containers": {
"adp": [
{
"providerMetadata": {
"dateUpdated": "2024-08-02T09:44:02.078Z",
"orgId": "af854a3a-2127-422b-91ae-364da2661108",
"shortName": "CVE"
},
"references": [
{
"name": "Microsoft Office Information Disclosure Vulnerability",
"tags": [
"vendor-advisory",
"x_transferred"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
}
],
"title": "CVE Program Container"
}
],
"cna": {
"affected": [
{
"platforms": [
"32-bit Systems",
"x64-based Systems"
],
"product": "Microsoft 365 Apps for Enterprise",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
},
{
"platforms": [
"x64-based Systems",
"32-bit Systems"
],
"product": "Microsoft Office LTSC 2021",
"vendor": "Microsoft",
"versions": [
{
"lessThan": "https://aka.ms/OfficeSecurityReleases",
"status": "affected",
"version": "16.0.1",
"versionType": "custom"
}
]
}
],
"cpeApplicability": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:365_apps:*:*:*:*:enterprise:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:*:*:*:*:*:*:*:*",
"versionEndExcluding": "https://aka.ms/OfficeSecurityReleases",
"versionStartIncluding": "16.0.1",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"datePublic": "2023-02-14T08:00:00+00:00",
"descriptions": [
{
"lang": "en-US",
"value": "Microsoft Office Information Disclosure Vulnerability"
}
],
"metrics": [
{
"cvssV3_1": {
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"format": "CVSS",
"scenarios": [
{
"lang": "en-US",
"value": "GENERAL"
}
]
}
],
"problemTypes": [
{
"descriptions": [
{
"cweId": "CWE-125",
"description": "CWE-125: Out-of-bounds Read",
"lang": "en-US",
"type": "CWE"
}
]
}
],
"providerMetadata": {
"dateUpdated": "2025-01-01T00:41:17.733Z",
"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"shortName": "microsoft"
},
"references": [
{
"name": "Microsoft Office Information Disclosure Vulnerability",
"tags": [
"vendor-advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
}
],
"title": "Microsoft Office Information Disclosure Vulnerability"
}
},
"cveMetadata": {
"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
"assignerShortName": "microsoft",
"cveId": "CVE-2023-21714",
"datePublished": "2023-02-14T19:33:43.757Z",
"dateReserved": "2022-12-13T18:08:03.491Z",
"dateUpdated": "2025-01-01T00:41:17.733Z",
"state": "PUBLISHED"
},
"dataType": "CVE_RECORD",
"dataVersion": "5.1",
"vulnerability-lookup:meta": {
"nvd": "{\"cve\":{\"id\":\"CVE-2023-21714\",\"sourceIdentifier\":\"secure@microsoft.com\",\"published\":\"2023-02-14T20:15:14.207\",\"lastModified\":\"2024-11-21T07:43:29.610\",\"vulnStatus\":\"Modified\",\"cveTags\":[],\"descriptions\":[{\"lang\":\"en\",\"value\":\"Microsoft Office Information Disclosure Vulnerability\"}],\"metrics\":{\"cvssMetricV31\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Primary\",\"cvssData\":{\"version\":\"3.1\",\"vectorString\":\"CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N\",\"baseScore\":5.5,\"baseSeverity\":\"MEDIUM\",\"attackVector\":\"LOCAL\",\"attackComplexity\":\"LOW\",\"privilegesRequired\":\"NONE\",\"userInteraction\":\"REQUIRED\",\"scope\":\"UNCHANGED\",\"confidentialityImpact\":\"HIGH\",\"integrityImpact\":\"NONE\",\"availabilityImpact\":\"NONE\"},\"exploitabilityScore\":1.8,\"impactScore\":3.6}]},\"weaknesses\":[{\"source\":\"secure@microsoft.com\",\"type\":\"Secondary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-125\"}]},{\"source\":\"nvd@nist.gov\",\"type\":\"Primary\",\"description\":[{\"lang\":\"en\",\"value\":\"CWE-668\"}]}],\"configurations\":[{\"nodes\":[{\"operator\":\"OR\",\"negate\":false,\"cpeMatch\":[{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*\",\"matchCriteriaId\":\"40C15EDD-98D4-4D06-BA06-21AE0F33C72D\"},{\"vulnerable\":true,\"criteria\":\"cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*\",\"matchCriteriaId\":\"0B3EF1E5-4757-4CFA-AE72-6BA876D3C9FD\"}]}]}],\"references\":[{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714\",\"source\":\"secure@microsoft.com\",\"tags\":[\"Patch\",\"Vendor Advisory\"]},{\"url\":\"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714\",\"source\":\"af854a3a-2127-422b-91ae-364da2661108\",\"tags\":[\"Patch\",\"Vendor Advisory\"]}]}}"
}
}
CERTFR-2023-AVI-0129
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans Microsoft Office. Elles permettent à un attaquant de provoquer une usurpation d'identité, une élévation de privilèges, une atteinte à la confidentialité des données et une exécution de code à distance.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | Office | Microsoft Office pour Android | ||
| Microsoft | Office | Microsoft Word 2016 (édition 32 bits) | ||
| Microsoft | Office | Microsoft Office LTSC 2021 pour éditions 64 bits | ||
| Microsoft | Office | Microsoft SharePoint Foundation 2013 Service Pack 1 | ||
| Microsoft | Office | Microsoft Office LTSC 2021 pour éditions 32 bits | ||
| Microsoft | Office | Microsoft Office Web Apps Server 2013 Service Pack 1 | ||
| Microsoft | Office | Microsoft OneNote pour Android | ||
| Microsoft | Office | Microsoft Office 2019 pour Mac | ||
| Microsoft | Office | Microsoft Word 2016 (édition 64 bits) | ||
| Microsoft | Office | Microsoft Office LTSC pour Mac 2021 | ||
| Microsoft | Office | Microsoft Word 2013 Service Pack 1 (éditions 32 bits) | ||
| Microsoft | Office | Microsoft Office pour Universal | ||
| Microsoft | Office | Microsoft Office Online Server | ||
| Microsoft | Office | Microsoft SharePoint Server Subscription Edition | ||
| Microsoft | Office | SharePoint Server Subscription Edition Language Pack | ||
| Microsoft | Office | Microsoft Office pour iOS | ||
| Microsoft | Office | Microsoft SharePoint Enterprise Server 2016 | ||
| Microsoft | Office | Microsoft Word 2013 Service Pack 1 (éditions 64 bits) | ||
| Microsoft | Office | Microsoft Word 2013 RT Service Pack 1 | ||
| Microsoft | Office | Microsoft SharePoint Server 2019 | ||
| Microsoft | Office | Microsoft SharePoint Enterprise Server 2013 Service Pack 1 |
References
| Title | Publication Time | Tags | |
|---|---|---|---|
|
|
|||
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Office pour Android",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Word 2016 (\u00e9dition 32 bits)",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC 2021 pour \u00e9ditions 64 bits",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Foundation 2013 Service Pack 1",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC 2021 pour \u00e9ditions 32 bits",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office Web Apps Server 2013 Service Pack 1",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft OneNote pour Android",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office 2019 pour Mac",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Word 2016 (\u00e9dition 64 bits)",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office LTSC pour Mac 2021",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Word 2013 Service Pack 1 (\u00e9ditions 32 bits)",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office pour Universal",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office Online Server",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server Subscription Edition",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "SharePoint Server Subscription Edition Language Pack",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Office pour iOS",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Enterprise Server 2016",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Word 2013 Service Pack 1 (\u00e9ditions 64 bits)",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Word 2013 RT Service Pack 1",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Server 2019",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SharePoint Enterprise Server 2013 Service Pack 1",
"product": {
"name": "Office",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21716",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21716"
},
{
"name": "CVE-2023-21823",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21823"
},
{
"name": "CVE-2023-21721",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21721"
},
{
"name": "CVE-2023-21717",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21717"
},
{
"name": "CVE-2023-21714",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21714"
}
],
"initial_release_date": "2023-02-15T00:00:00",
"last_revision_date": "2023-02-15T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21716 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21721 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21721"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21714 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21717 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21717"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21823 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21823"
}
],
"reference": "CERTFR-2023-AVI-0129",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eMicrosoft Office\u003c/span\u003e. Elles permettent \u00e0 un attaquant\nde provoquer une usurpation d\u0027identit\u00e9, une \u00e9l\u00e9vation de privil\u00e8ges, une\natteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es et une ex\u00e9cution de code \u00e0\ndistance.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans Microsoft Office",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
CERTFR-2023-AVI-0133
Vulnerability from certfr_avis
De multiples vulnérabilités ont été corrigées dans les produits Microsoft. Elles permettent à un attaquant de provoquer une usurpation d'identité, une exécution de code à distance, une élévation de privilèges, une atteinte à la confidentialité des données, un contournement de la fonctionnalité de sécurité et un déni de service.
Solution
Se référer au bulletin de sécurité de l'éditeur pour l'obtention des correctifs (cf. section Documentation).
NoneImpacted products
| Vendor | Product | Description | ||
|---|---|---|---|---|
| Microsoft | N/A | Microsoft Exchange Server 2013 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.0 | ||
| Microsoft | N/A | Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8) | ||
| Microsoft | N/A | HoloLens 1 | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.2 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (CU 18) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (CU 4) | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 11 | ||
| Microsoft | N/A | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2022 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Exchange Server 2016 Cumulative Update 23 | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (CU 4) | ||
| Microsoft | N/A | Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10) | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Dynamics 365 Unified Service Desk | ||
| Microsoft | N/A | Power BI Report Server - January 2023 | ||
| Microsoft | Azure | Microsoft SQL Server 2016 pour systèmes x64 Service Pack 3 Azure Connectivity Pack | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.1 | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour systèmes 32 bits | ||
| Microsoft | N/A | Microsoft 365 Apps pour Enterprise pour 64 bits Systems | ||
| Microsoft | N/A | Print 3D | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft SQL Server 2017 pour systèmes x64 (CU 31) | ||
| Microsoft | N/A | Microsoft Visual Studio 2022 version 17.4 | ||
| Microsoft | N/A | Microsoft SQL Server 2019 pour systèmes x64 (GDR) | ||
| Microsoft | N/A | Microsoft Defender pour IoT | ||
| Microsoft | N/A | Microsoft Defender Security Intelligence Updates | ||
| Microsoft | N/A | Microsoft Dynamics 365 (on-premises) version 9.0 | ||
| Microsoft | N/A | Microsoft Exchange Server 2019 Cumulative Update 12 | ||
| Microsoft | N/A | 3D Builder | ||
| Microsoft | N/A | Microsoft SQL Server 2014 Service Pack 3 pour systèmes 32 bits (GDR) |
References
{
"$ref": "https://www.cert.ssi.gouv.fr/openapi.json",
"affected_systems": [
{
"description": "Microsoft Exchange Server 2013 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "HoloLens 1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.2",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (CU 18)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 11",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2022 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2016 Cumulative Update 23",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (CU 4)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 Unified Service Desk",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Power BI Report Server - January 2023",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2016 pour syst\u00e8mes x64 Service Pack 3 Azure Connectivity Pack",
"product": {
"name": "Azure",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.1",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour syst\u00e8mes 32 bits",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft 365 Apps pour Enterprise pour 64 bits Systems",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Print 3D",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2017 pour syst\u00e8mes x64 (CU 31)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Visual Studio 2022 version 17.4",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2019 pour syst\u00e8mes x64 (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender pour IoT",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Defender Security Intelligence Updates",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Dynamics 365 (on-premises) version 9.0",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft Exchange Server 2019 Cumulative Update 12",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "3D Builder",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
},
{
"description": "Microsoft SQL Server 2014 Service Pack 3 pour syst\u00e8mes 32 bits (GDR)",
"product": {
"name": "N/A",
"vendor": {
"name": "Microsoft",
"scada": false
}
}
}
],
"affected_systems_content": null,
"content": "## Solution\n\nSe r\u00e9f\u00e9rer au bulletin de s\u00e9curit\u00e9 de l\u0027\u00e9diteur pour l\u0027obtention des\ncorrectifs (cf. section Documentation).\n",
"cves": [
{
"name": "CVE-2023-21715",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21715"
},
{
"name": "CVE-2023-21568",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21568"
},
{
"name": "CVE-2023-23379",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23379"
},
{
"name": "CVE-2022-23521",
"url": "https://www.cve.org/CVERecord?id=CVE-2022-23521"
},
{
"name": "CVE-2023-21567",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21567"
},
{
"name": "CVE-2023-21718",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21718"
},
{
"name": "CVE-2023-21716",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21716"
},
{
"name": "CVE-2023-21572",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21572"
},
{
"name": "CVE-2019-15126",
"url": "https://www.cve.org/CVERecord?id=CVE-2019-15126"
},
{
"name": "CVE-2023-21705",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21705"
},
{
"name": "CVE-2023-21529",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21529"
},
{
"name": "CVE-2023-21710",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21710"
},
{
"name": "CVE-2023-21571",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21571"
},
{
"name": "CVE-2023-21778",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21778"
},
{
"name": "CVE-2023-21809",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21809"
},
{
"name": "CVE-2023-23390",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23390"
},
{
"name": "CVE-2023-23377",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23377"
},
{
"name": "CVE-2023-23381",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23381"
},
{
"name": "CVE-2023-21566",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21566"
},
{
"name": "CVE-2023-21806",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21806"
},
{
"name": "CVE-2023-21807",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21807"
},
{
"name": "CVE-2023-21714",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21714"
},
{
"name": "CVE-2023-21706",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21706"
},
{
"name": "CVE-2023-21713",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21713"
},
{
"name": "CVE-2023-21808",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21808"
},
{
"name": "CVE-2023-21573",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21573"
},
{
"name": "CVE-2023-21528",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21528"
},
{
"name": "CVE-2023-41953",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-41953"
},
{
"name": "CVE-2023-21704",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21704"
},
{
"name": "CVE-2023-21570",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21570"
},
{
"name": "CVE-2023-21707",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21707"
},
{
"name": "CVE-2023-21815",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-21815"
},
{
"name": "CVE-2023-23378",
"url": "https://www.cve.org/CVERecord?id=CVE-2023-23378"
}
],
"initial_release_date": "2023-02-15T00:00:00",
"last_revision_date": "2023-02-15T00:00:00",
"links": [
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21716 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21713 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21713"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2019-15126 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2019-15126"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21566 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21566"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21808 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21808"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21705 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21705"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21707 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21707"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21568 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21568"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21571 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21571"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21806 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21806"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21573 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21573"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21570 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21570"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21572 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21572"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21714 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23379 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23377 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23377"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21815 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21815"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21710 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21710"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21715 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21718 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21718"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21706 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21706"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21529 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21529"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21528 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21528"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2022-23521 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-23521"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23378 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23378"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21704 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21704"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21567 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21567"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23390 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23390"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21807 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21807"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21809 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21809"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-21778 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21778"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-41953 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-41953"
},
{
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft CVE-2023-23381 du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23381"
}
],
"reference": "CERTFR-2023-AVI-0133",
"revisions": [
{
"description": "Version initiale",
"revision_date": "2023-02-15T00:00:00.000000"
}
],
"risks": [
{
"description": "Usurpation d\u0027identit\u00e9"
},
{
"description": "Ex\u00e9cution de code arbitraire \u00e0 distance"
},
{
"description": "D\u00e9ni de service"
},
{
"description": "Contournement de la fonctionnalit\u00e9 de s\u00e9curit\u00e9"
},
{
"description": "Atteinte \u00e0 la confidentialit\u00e9 des donn\u00e9es"
},
{
"description": "\u00c9l\u00e9vation de privil\u00e8ges"
}
],
"summary": "De multiples vuln\u00e9rabilit\u00e9s ont \u00e9t\u00e9 corrig\u00e9es dans \u003cspan\nclass=\"textit\"\u003eles produits Microsoft\u003c/span\u003e. Elles permettent \u00e0 un\nattaquant de provoquer une usurpation d\u0027identit\u00e9, une ex\u00e9cution de code\n\u00e0 distance, une \u00e9l\u00e9vation de privil\u00e8ges, une atteinte \u00e0 la\nconfidentialit\u00e9 des donn\u00e9es, un contournement de la fonctionnalit\u00e9 de\ns\u00e9curit\u00e9 et un d\u00e9ni de service.\n",
"title": "Multiples vuln\u00e9rabilit\u00e9s dans les produits Microsoft",
"vendor_advisories": [
{
"published_at": null,
"title": "Bulletin de s\u00e9curit\u00e9 Microsoft du 14 f\u00e9vrier 2023",
"url": "https://msrc.microsoft.com/update-guide/"
}
]
}
msrc_cve-2023-21714
Vulnerability from csaf_microsoft
Published
2023-02-14 08:00
Modified
2023-02-14 08:00
Summary
Microsoft Office Information Disclosure Vulnerability
Notes
Additional Resources
To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle
Disclaimer
The information provided in the Microsoft Knowledge Base is provided \"as is\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.
Customer Action
Required. The vulnerability documented by this CVE requires customer action to resolve.
{
"document": {
"acknowledgments": [
{
"names": [
"willJ of vulnerability research institute"
]
}
],
"aggregate_severity": {
"namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
"text": "Important"
},
"category": "csaf_security_advisory",
"csaf_version": "2.0",
"distribution": {
"text": "Public",
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "en-US",
"notes": [
{
"category": "general",
"text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
"title": "Additional Resources"
},
{
"category": "legal_disclaimer",
"text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
"title": "Disclaimer"
},
{
"category": "general",
"text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
"title": "Customer Action"
}
],
"publisher": {
"category": "vendor",
"contact_details": "secure@microsoft.com",
"name": "Microsoft Security Response Center",
"namespace": "https://msrc.microsoft.com"
},
"references": [
{
"category": "self",
"summary": "CVE-2023-21714 Microsoft Office Information Disclosure Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"category": "self",
"summary": "CVE-2023-21714 Microsoft Office Information Disclosure Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-21714.json"
},
{
"category": "external",
"summary": "Microsoft Exploitability Index",
"url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
},
{
"category": "external",
"summary": "Microsoft Support Lifecycle",
"url": "https://support.microsoft.com/lifecycle"
},
{
"category": "external",
"summary": "Common Vulnerability Scoring System",
"url": "https://www.first.org/cvss"
}
],
"title": "Microsoft Office Information Disclosure Vulnerability",
"tracking": {
"current_release_date": "2023-02-14T08:00:00.000Z",
"generator": {
"date": "2025-01-01T00:40:39.977Z",
"engine": {
"name": "MSRC Generator",
"version": "1.0"
}
},
"id": "msrc_CVE-2023-21714",
"initial_release_date": "2023-02-14T08:00:00.000Z",
"revision_history": [
{
"date": "2023-02-14T08:00:00.000Z",
"legacy_version": "1",
"number": "1",
"summary": "Information published."
}
],
"status": "final",
"version": "1"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_version_range",
"name": "\u003chttps://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft 365 Apps for Enterprise for 32-bit Systems \u003chttps://aka.ms/OfficeSecurityReleases",
"product_id": "4"
}
},
{
"category": "product_version",
"name": "https://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft 365 Apps for Enterprise for 32-bit Systems https://aka.ms/OfficeSecurityReleases",
"product_id": "11762"
}
}
],
"category": "product_name",
"name": "Microsoft 365 Apps for Enterprise for 32-bit Systems"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003chttps://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft 365 Apps for Enterprise for 64-bit Systems \u003chttps://aka.ms/OfficeSecurityReleases",
"product_id": "3"
}
},
{
"category": "product_version",
"name": "https://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft 365 Apps for Enterprise for 64-bit Systems https://aka.ms/OfficeSecurityReleases",
"product_id": "11763"
}
}
],
"category": "product_name",
"name": "Microsoft 365 Apps for Enterprise for 64-bit Systems"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003chttps://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft Office LTSC 2021 for 64-bit editions \u003chttps://aka.ms/OfficeSecurityReleases",
"product_id": "2"
}
},
{
"category": "product_version",
"name": "https://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft Office LTSC 2021 for 64-bit editions https://aka.ms/OfficeSecurityReleases",
"product_id": "11952"
}
}
],
"category": "product_name",
"name": "Microsoft Office LTSC 2021 for 64-bit editions"
},
{
"branches": [
{
"category": "product_version_range",
"name": "\u003chttps://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft Office LTSC 2021 for 32-bit editions \u003chttps://aka.ms/OfficeSecurityReleases",
"product_id": "1"
}
},
{
"category": "product_version",
"name": "https://aka.ms/OfficeSecurityReleases",
"product": {
"name": "Microsoft Office LTSC 2021 for 32-bit editions https://aka.ms/OfficeSecurityReleases",
"product_id": "11953"
}
}
],
"category": "product_name",
"name": "Microsoft Office LTSC 2021 for 32-bit editions"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-21714",
"cwe": {
"id": "CWE-125",
"name": "Out-of-bounds Read"
},
"notes": [
{
"category": "general",
"text": "Microsoft",
"title": "Assigning CNA"
},
{
"category": "faq",
"text": "No, the Preview Pane is not an attack vector.",
"title": "Is the Preview Pane an attack vector for this vulnerability?"
},
{
"category": "faq",
"text": "Exploitation of the vulnerability requires that a user open a specially crafted file.\nIn an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file., In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.\nAn attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or instant message, and then convince them to open the specially crafted file.",
"title": "According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?"
},
{
"category": "faq",
"text": "The type of information that could be disclosed if an attacker successfully exploited this vulnerability is uninitialized memory.",
"title": "What type of information could be disclosed by this vulnerability?"
}
],
"product_status": {
"fixed": [
"11762",
"11763",
"11952",
"11953"
],
"known_affected": [
"1",
"2",
"3",
"4"
]
},
"references": [
{
"category": "self",
"summary": "CVE-2023-21714 Microsoft Office Information Disclosure Vulnerability - HTML",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"category": "self",
"summary": "CVE-2023-21714 Microsoft Office Information Disclosure Vulnerability - CSAF",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
}
],
"remediations": [
{
"category": "vendor_fix",
"date": "2023-02-14T08:00:00.000Z",
"details": "https://aka.ms/OfficeSecurityReleases:Security Update:https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates",
"product_ids": [
"4",
"3",
"2",
"1"
],
"url": "https://docs.microsoft.com/en-us/officeupdates/office365-proplus-security-updates"
}
],
"scores": [
{
"cvss_v3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"environmentalsScore": 0.0,
"exploitCodeMaturity": "UNPROVEN",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"remediationLevel": "OFFICIAL_FIX",
"reportConfidence": "CONFIRMED",
"scope": "UNCHANGED",
"temporalScore": 4.8,
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
},
"products": [
"1",
"2",
"3",
"4"
]
}
],
"threats": [
{
"category": "impact",
"details": "Information Disclosure"
},
{
"category": "exploit_status",
"details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
}
],
"title": "Microsoft Office Information Disclosure Vulnerability"
}
]
}
wid-sec-w-2023-0391
Vulnerability from csaf_certbund
Published
2023-02-14 23:00
Modified
2023-03-06 23:00
Summary
Microsoft Office Produkte: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die Microsoft Office Suite beinhaltet zahlreiche Büroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.
Microsoft Sharepoint ist ein Portalsystem für die zentrale Verwaltung von Dokumenten und Anwendungen. Die Inhalte werden u. a. über Webseiten zur Verfügung gestellt.
Angriff
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Office und SharePoint Produkten ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmechanismen zu umgehen und Informationen offenzulegen.
Betroffene Betriebssysteme
- MacOS X
- Windows
- Android
- iPhoneOS
{
"document": {
"aggregate_severity": {
"text": "kritisch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Die Microsoft Office Suite beinhaltet zahlreiche B\u00fcroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.\r\nMicrosoft Sharepoint ist ein Portalsystem f\u00fcr die zentrale Verwaltung von Dokumenten und Anwendungen. Die Inhalte werden u. a. \u00fcber Webseiten zur Verf\u00fcgung gestellt.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Office und SharePoint Produkten ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Sicherheitsmechanismen zu umgehen und Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- MacOS X\n- Windows\n- Android\n- iPhoneOS",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0391 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0391.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0391 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0391"
},
{
"category": "external",
"summary": "PoC auf Helpnet Security vom 2023-02-14",
"url": "https://www.helpnetsecurity.com/2023/03/06/cve-2023-21716-poc/"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-02-14",
"url": "https://msrc.microsoft.com/update-guide"
}
],
"source_lang": "en-US",
"title": "Microsoft Office Produkte: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-03-06T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:43:47.760+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0391",
"initial_release_date": "2023-02-14T23:00:00.000+00:00",
"revision_history": [
{
"date": "2023-02-14T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-03-06T23:00:00.000+00:00",
"number": "2",
"summary": "PoC aufgenommen"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Microsoft 365 Apps",
"product": {
"name": "Microsoft 365 Apps",
"product_id": "T016910",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:365_apps:-"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Office LTSC for Mac 2021",
"product": {
"name": "Microsoft Office LTSC for Mac 2021",
"product_id": "T020985",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:ltsc_for_mac_2021"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office LTSC 2021",
"product": {
"name": "Microsoft Office LTSC 2021",
"product_id": "T020986",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:ltsc_2021"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office for Android",
"product": {
"name": "Microsoft Office for Android",
"product_id": "T026296",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:for_android"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office for Universal",
"product": {
"name": "Microsoft Office for Universal",
"product_id": "T026297",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:for_universal"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office for iOS",
"product": {
"name": "Microsoft Office for iOS",
"product_id": "T026298",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:for_ios"
}
}
}
],
"category": "product_name",
"name": "Office"
},
{
"category": "product_name",
"name": "Microsoft Office 2019 for Mac",
"product": {
"name": "Microsoft Office 2019 for Mac",
"product_id": "T014533",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office_2019_for_mac:-"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office Online Server",
"product": {
"name": "Microsoft Office Online Server",
"product_id": "921247",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office_online_server:2016"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office Web Apps Server 2013 SP1",
"product": {
"name": "Microsoft Office Web Apps Server 2013 SP1",
"product_id": "T016915",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office_web_apps_server_2013:sp1"
}
}
},
{
"category": "product_name",
"name": "Microsoft OneNote for Android",
"product": {
"name": "Microsoft OneNote for Android",
"product_id": "T026299",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:onenote:for_android"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft SharePoint Enterprise Server 2016",
"product": {
"name": "Microsoft SharePoint Enterprise Server 2016",
"product_id": "T018556",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:enterprise_server_2016"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Enterprise Server 2013 SP1",
"product": {
"name": "Microsoft SharePoint Enterprise Server 2013 SP1",
"product_id": "T020103",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:enterprise_server_2013_sp1"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Server Subscription Edition",
"product": {
"name": "Microsoft SharePoint Server Subscription Edition",
"product_id": "T021526",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:server_subscription_edition"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Server Subscription Edition Language Pack",
"product": {
"name": "Microsoft SharePoint Server Subscription Edition Language Pack",
"product_id": "T021527",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:server_subscription_edition_language_pack"
}
}
}
],
"category": "product_name",
"name": "SharePoint"
},
{
"category": "product_name",
"name": "Microsoft SharePoint Foundation 2013 SP1",
"product": {
"name": "Microsoft SharePoint Foundation 2013 SP1",
"product_id": "T014519",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint_foundation_2013:sp1"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Server 2019",
"product": {
"name": "Microsoft SharePoint Server 2019",
"product_id": "T014523",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint_server_2019:-"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Word 2013 RT SP1",
"product": {
"name": "Microsoft Word 2013 RT SP1",
"product_id": "T015485",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:word_2013:rt_sp_1"
}
}
},
{
"category": "product_name",
"name": "Microsoft Word 2013 SP1",
"product": {
"name": "Microsoft Word 2013 SP1",
"product_id": "T015486",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:word_2013:sp_1"
}
}
}
],
"category": "product_name",
"name": "Word 2013"
},
{
"category": "product_name",
"name": "Microsoft Word 2016",
"product": {
"name": "Microsoft Word 2016",
"product_id": "T015487",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:word_2016:-"
}
}
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-21714",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21714"
},
{
"cve": "CVE-2023-21715",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21715"
},
{
"cve": "CVE-2023-21716",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21716"
},
{
"cve": "CVE-2023-21717",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21717"
},
{
"cve": "CVE-2023-21721",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21721"
},
{
"cve": "CVE-2023-21823",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21823"
}
]
}
WID-SEC-W-2023-0391
Vulnerability from csaf_certbund
Published
2023-02-14 23:00
Modified
2023-03-06 23:00
Summary
Microsoft Office Produkte: Mehrere Schwachstellen
Notes
Das BSI ist als Anbieter für die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch dafür verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgfältig im Einzelfall zu prüfen.
Produktbeschreibung
Die Microsoft Office Suite beinhaltet zahlreiche Büroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.
Microsoft Sharepoint ist ein Portalsystem für die zentrale Verwaltung von Dokumenten und Anwendungen. Die Inhalte werden u. a. über Webseiten zur Verfügung gestellt.
Angriff
Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Office und SharePoint Produkten ausnutzen, um seine Privilegien zu erhöhen, beliebigen Code auszuführen, Sicherheitsmechanismen zu umgehen und Informationen offenzulegen.
Betroffene Betriebssysteme
- MacOS X
- Windows
- Android
- iPhoneOS
{
"document": {
"aggregate_severity": {
"text": "kritisch"
},
"category": "csaf_base",
"csaf_version": "2.0",
"distribution": {
"tlp": {
"label": "WHITE",
"url": "https://www.first.org/tlp/"
}
},
"lang": "de-DE",
"notes": [
{
"category": "legal_disclaimer",
"text": "Das BSI ist als Anbieter f\u00fcr die eigenen, zur Nutzung bereitgestellten Inhalte nach den allgemeinen Gesetzen verantwortlich. Nutzerinnen und Nutzer sind jedoch daf\u00fcr verantwortlich, die Verwendung und/oder die Umsetzung der mit den Inhalten bereitgestellten Informationen sorgf\u00e4ltig im Einzelfall zu pr\u00fcfen."
},
{
"category": "description",
"text": "Die Microsoft Office Suite beinhaltet zahlreiche B\u00fcroanwendungen wie Textverarbeitung, Tabellenkalkulation, Datenbank und weitere Applikationen.\r\nMicrosoft Sharepoint ist ein Portalsystem f\u00fcr die zentrale Verwaltung von Dokumenten und Anwendungen. Die Inhalte werden u. a. \u00fcber Webseiten zur Verf\u00fcgung gestellt.",
"title": "Produktbeschreibung"
},
{
"category": "summary",
"text": "Ein entfernter, anonymer oder authentisierter Angreifer kann mehrere Schwachstellen in verschiedenen Microsoft Office und SharePoint Produkten ausnutzen, um seine Privilegien zu erh\u00f6hen, beliebigen Code auszuf\u00fchren, Sicherheitsmechanismen zu umgehen und Informationen offenzulegen.",
"title": "Angriff"
},
{
"category": "general",
"text": "- MacOS X\n- Windows\n- Android\n- iPhoneOS",
"title": "Betroffene Betriebssysteme"
}
],
"publisher": {
"category": "other",
"contact_details": "csaf-provider@cert-bund.de",
"name": "Bundesamt f\u00fcr Sicherheit in der Informationstechnik",
"namespace": "https://www.bsi.bund.de"
},
"references": [
{
"category": "self",
"summary": "WID-SEC-W-2023-0391 - CSAF Version",
"url": "https://wid.cert-bund.de/.well-known/csaf/white/2023/wid-sec-w-2023-0391.json"
},
{
"category": "self",
"summary": "WID-SEC-2023-0391 - Portal Version",
"url": "https://wid.cert-bund.de/portal/wid/securityadvisory?name=WID-SEC-2023-0391"
},
{
"category": "external",
"summary": "PoC auf Helpnet Security vom 2023-02-14",
"url": "https://www.helpnetsecurity.com/2023/03/06/cve-2023-21716-poc/"
},
{
"category": "external",
"summary": "Microsoft Leitfaden f\u00fcr Sicherheitsupdates vom 2023-02-14",
"url": "https://msrc.microsoft.com/update-guide"
}
],
"source_lang": "en-US",
"title": "Microsoft Office Produkte: Mehrere Schwachstellen",
"tracking": {
"current_release_date": "2023-03-06T23:00:00.000+00:00",
"generator": {
"date": "2024-08-15T17:43:47.760+00:00",
"engine": {
"name": "BSI-WID",
"version": "1.3.5"
}
},
"id": "WID-SEC-W-2023-0391",
"initial_release_date": "2023-02-14T23:00:00.000+00:00",
"revision_history": [
{
"date": "2023-02-14T23:00:00.000+00:00",
"number": "1",
"summary": "Initiale Fassung"
},
{
"date": "2023-03-06T23:00:00.000+00:00",
"number": "2",
"summary": "PoC aufgenommen"
}
],
"status": "final",
"version": "2"
}
},
"product_tree": {
"branches": [
{
"branches": [
{
"category": "product_name",
"name": "Microsoft 365 Apps",
"product": {
"name": "Microsoft 365 Apps",
"product_id": "T016910",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:365_apps:-"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Office LTSC for Mac 2021",
"product": {
"name": "Microsoft Office LTSC for Mac 2021",
"product_id": "T020985",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:ltsc_for_mac_2021"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office LTSC 2021",
"product": {
"name": "Microsoft Office LTSC 2021",
"product_id": "T020986",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:ltsc_2021"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office for Android",
"product": {
"name": "Microsoft Office for Android",
"product_id": "T026296",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:for_android"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office for Universal",
"product": {
"name": "Microsoft Office for Universal",
"product_id": "T026297",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:for_universal"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office for iOS",
"product": {
"name": "Microsoft Office for iOS",
"product_id": "T026298",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office:for_ios"
}
}
}
],
"category": "product_name",
"name": "Office"
},
{
"category": "product_name",
"name": "Microsoft Office 2019 for Mac",
"product": {
"name": "Microsoft Office 2019 for Mac",
"product_id": "T014533",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office_2019_for_mac:-"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office Online Server",
"product": {
"name": "Microsoft Office Online Server",
"product_id": "921247",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office_online_server:2016"
}
}
},
{
"category": "product_name",
"name": "Microsoft Office Web Apps Server 2013 SP1",
"product": {
"name": "Microsoft Office Web Apps Server 2013 SP1",
"product_id": "T016915",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:office_web_apps_server_2013:sp1"
}
}
},
{
"category": "product_name",
"name": "Microsoft OneNote for Android",
"product": {
"name": "Microsoft OneNote for Android",
"product_id": "T026299",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:onenote:for_android"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft SharePoint Enterprise Server 2016",
"product": {
"name": "Microsoft SharePoint Enterprise Server 2016",
"product_id": "T018556",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:enterprise_server_2016"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Enterprise Server 2013 SP1",
"product": {
"name": "Microsoft SharePoint Enterprise Server 2013 SP1",
"product_id": "T020103",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:enterprise_server_2013_sp1"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Server Subscription Edition",
"product": {
"name": "Microsoft SharePoint Server Subscription Edition",
"product_id": "T021526",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:server_subscription_edition"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Server Subscription Edition Language Pack",
"product": {
"name": "Microsoft SharePoint Server Subscription Edition Language Pack",
"product_id": "T021527",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint:server_subscription_edition_language_pack"
}
}
}
],
"category": "product_name",
"name": "SharePoint"
},
{
"category": "product_name",
"name": "Microsoft SharePoint Foundation 2013 SP1",
"product": {
"name": "Microsoft SharePoint Foundation 2013 SP1",
"product_id": "T014519",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint_foundation_2013:sp1"
}
}
},
{
"category": "product_name",
"name": "Microsoft SharePoint Server 2019",
"product": {
"name": "Microsoft SharePoint Server 2019",
"product_id": "T014523",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:sharepoint_server_2019:-"
}
}
},
{
"branches": [
{
"category": "product_name",
"name": "Microsoft Word 2013 RT SP1",
"product": {
"name": "Microsoft Word 2013 RT SP1",
"product_id": "T015485",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:word_2013:rt_sp_1"
}
}
},
{
"category": "product_name",
"name": "Microsoft Word 2013 SP1",
"product": {
"name": "Microsoft Word 2013 SP1",
"product_id": "T015486",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:word_2013:sp_1"
}
}
}
],
"category": "product_name",
"name": "Word 2013"
},
{
"category": "product_name",
"name": "Microsoft Word 2016",
"product": {
"name": "Microsoft Word 2016",
"product_id": "T015487",
"product_identification_helper": {
"cpe": "cpe:/a:microsoft:word_2016:-"
}
}
}
],
"category": "vendor",
"name": "Microsoft"
}
]
},
"vulnerabilities": [
{
"cve": "CVE-2023-21714",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21714"
},
{
"cve": "CVE-2023-21715",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21715"
},
{
"cve": "CVE-2023-21716",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21716"
},
{
"cve": "CVE-2023-21717",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21717"
},
{
"cve": "CVE-2023-21721",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21721"
},
{
"cve": "CVE-2023-21823",
"notes": [
{
"category": "description",
"text": "In verschiedenen Microsoft Office und SharePoint Produkten existieren mehrere Schwachstellen. Ein Angreifer kann dadurch seine Privilegien auf SYSTEM Rechte ausweiten, beliebigen Code zur Ausf\u00fchrung bringen, Sicherheitsmechanismen umgehen und Informationen offenlegen. F\u00fcr die Ausnutzung einiger Schwachstellen ist eine Benutzeraktion erforderlich."
}
],
"product_status": {
"known_affected": [
"T014519",
"T026296",
"T016915",
"921247",
"T014533",
"T016910",
"T014523",
"T015487",
"T015486",
"T015485",
"T020103",
"T018556",
"T021527",
"T021526",
"T020986",
"T020985",
"T026298",
"T026297",
"T026299"
]
},
"release_date": "2023-02-14T23:00:00.000+00:00",
"title": "CVE-2023-21823"
}
]
}
fkie_cve-2023-21714
Vulnerability from fkie_nvd
Published
2023-02-14 20:15
Modified
2024-11-21 07:43
Severity ?
Summary
Microsoft Office Information Disclosure Vulnerability
References
| URL | Tags | ||
|---|---|---|---|
| secure@microsoft.com | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714 | Patch, Vendor Advisory | |
| af854a3a-2127-422b-91ae-364da2661108 | https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714 | Patch, Vendor Advisory |
Impacted products
| Vendor | Product | Version | |
|---|---|---|---|
| microsoft | 365_apps | - | |
| microsoft | office_long_term_servicing_channel | 2021 |
{
"configurations": [
{
"nodes": [
{
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*",
"matchCriteriaId": "40C15EDD-98D4-4D06-BA06-21AE0F33C72D",
"vulnerable": true
},
{
"criteria": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*",
"matchCriteriaId": "0B3EF1E5-4757-4CFA-AE72-6BA876D3C9FD",
"vulnerable": true
}
],
"negate": false,
"operator": "OR"
}
]
}
],
"cveTags": [],
"descriptions": [
{
"lang": "en",
"value": "Microsoft Office Information Disclosure Vulnerability"
}
],
"id": "CVE-2023-21714",
"lastModified": "2024-11-21T07:43:29.610",
"metrics": {
"cvssMetricV31": [
{
"cvssData": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6,
"source": "secure@microsoft.com",
"type": "Primary"
}
]
},
"published": "2023-02-14T20:15:14.207",
"references": [
{
"source": "secure@microsoft.com",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
},
{
"source": "af854a3a-2127-422b-91ae-364da2661108",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
}
],
"sourceIdentifier": "secure@microsoft.com",
"vulnStatus": "Modified",
"weaknesses": [
{
"description": [
{
"lang": "en",
"value": "CWE-125"
}
],
"source": "secure@microsoft.com",
"type": "Secondary"
},
{
"description": [
{
"lang": "en",
"value": "CWE-668"
}
],
"source": "nvd@nist.gov",
"type": "Primary"
}
]
}
gsd-2023-21714
Vulnerability from gsd
Modified
2023-12-13 01:20
Details
Microsoft Office Information Disclosure Vulnerability
Aliases
Aliases
{
"GSD": {
"alias": "CVE-2023-21714",
"id": "GSD-2023-21714"
},
"gsd": {
"metadata": {
"exploitCode": "unknown",
"remediation": "unknown",
"reportConfidence": "confirmed",
"type": "vulnerability"
},
"osvSchema": {
"aliases": [
"CVE-2023-21714"
],
"details": "Microsoft Office Information Disclosure Vulnerability",
"id": "GSD-2023-21714",
"modified": "2023-12-13T01:20:25.367029Z",
"schema_version": "1.4.0"
}
},
"namespaces": {
"cve.org": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-21714",
"STATE": "PUBLIC"
},
"affects": {
"vendor": {
"vendor_data": [
{
"product": {
"product_data": [
{
"product_name": "Microsoft 365 Apps for Enterprise",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "16.0.1",
"version_value": "https://aka.ms/OfficeSecurityReleases"
}
]
}
},
{
"product_name": "Microsoft Office LTSC 2021",
"version": {
"version_data": [
{
"version_affected": "\u003c",
"version_name": "16.0.1",
"version_value": "https://aka.ms/OfficeSecurityReleases"
}
]
}
}
]
},
"vendor_name": "Microsoft"
}
]
}
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "eng",
"value": "Microsoft Office Information Disclosure Vulnerability"
}
]
},
"impact": {
"cvss": [
{
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C",
"version": "3.1"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "eng",
"value": "Information Disclosure"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714",
"refsource": "MISC",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
}
]
}
},
"nvd.nist.gov": {
"configurations": {
"CVE_data_version": "4.0",
"nodes": [
{
"children": [],
"cpe_match": [
{
"cpe23Uri": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*",
"cpe_name": [],
"vulnerable": true
},
{
"cpe23Uri": "cpe:2.3:a:microsoft:office_long_term_servicing_channel:2021:*:*:*:*:*:*:*",
"cpe_name": [],
"vulnerable": true
}
],
"operator": "OR"
}
]
},
"cve": {
"CVE_data_meta": {
"ASSIGNER": "secure@microsoft.com",
"ID": "CVE-2023-21714"
},
"data_format": "MITRE",
"data_type": "CVE",
"data_version": "4.0",
"description": {
"description_data": [
{
"lang": "en",
"value": "Microsoft Office Information Disclosure Vulnerability"
}
]
},
"problemtype": {
"problemtype_data": [
{
"description": [
{
"lang": "en",
"value": "CWE-668"
}
]
}
]
},
"references": {
"reference_data": [
{
"name": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714",
"refsource": "MISC",
"tags": [
"Patch",
"Vendor Advisory"
],
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
}
]
}
},
"impact": {
"baseMetricV3": {
"cvssV3": {
"attackComplexity": "LOW",
"attackVector": "LOCAL",
"availabilityImpact": "NONE",
"baseScore": 5.5,
"baseSeverity": "MEDIUM",
"confidentialityImpact": "HIGH",
"integrityImpact": "NONE",
"privilegesRequired": "NONE",
"scope": "UNCHANGED",
"userInteraction": "REQUIRED",
"vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"version": "3.1"
},
"exploitabilityScore": 1.8,
"impactScore": 3.6
}
},
"lastModifiedDate": "2023-02-23T15:45Z",
"publishedDate": "2023-02-14T20:15Z"
}
}
}
ghsa-4v8x-g9mf-87fr
Vulnerability from github
Published
2023-02-14 21:30
Modified
2023-02-14 21:30
Severity ?
VLAI Severity ?
Details
Microsoft Office Information Disclosure Vulnerability
{
"affected": [],
"aliases": [
"CVE-2023-21714"
],
"database_specific": {
"cwe_ids": [
"CWE-668"
],
"github_reviewed": false,
"github_reviewed_at": null,
"nvd_published_at": "2023-02-14T20:15:00Z",
"severity": "MODERATE"
},
"details": "Microsoft Office Information Disclosure Vulnerability",
"id": "GHSA-4v8x-g9mf-87fr",
"modified": "2023-02-14T21:30:29Z",
"published": "2023-02-14T21:30:29Z",
"references": [
{
"type": "ADVISORY",
"url": "https://nvd.nist.gov/vuln/detail/CVE-2023-21714"
},
{
"type": "WEB",
"url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21714"
}
],
"schema_version": "1.4.0",
"severity": [
{
"score": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N",
"type": "CVSS_V3"
}
]
}
Loading…
Loading…
Sightings
| Author | Source | Type | Date |
|---|
Nomenclature
- Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
- Confirmed: The vulnerability is confirmed from an analyst perspective.
- Published Proof of Concept: A public proof of concept is available for this vulnerability.
- Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
- Patched: This vulnerability was successfully patched by the user reporting the sighting.
- Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
- Not confirmed: The user expresses doubt about the veracity of the vulnerability.
- Not patched: This vulnerability was not successfully patched by the user reporting the sighting.
Loading…
Loading…