{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Yiming Xiang with \u003ca href=\"https://www.nsfocus.cn/\"\u003eNSFOCUS TIANJI LAB\u003c/a\u003e"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2023-23379 Microsoft Defender for IoT Elevation of Privilege Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379"
      },
      {
        "category": "self",
        "summary": "CVE-2023-23379 Microsoft Defender for IoT Elevation of Privilege Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-23379.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Microsoft Defender for IoT Elevation of Privilege Vulnerability",
    "tracking": {
      "current_release_date": "2023-04-18T07:00:00.000Z",
      "generator": {
        "date": "2025-01-01T00:40:39.929Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2023-23379",
      "initial_release_date": "2023-02-14T08:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-02-14T08:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2023-04-14T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Updated one or more CVSS scores for the affected products. This is an informational change only."
        },
        {
          "date": "2023-04-18T07:00:00.000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added an FAQ and updated the CVSS score. This is an informational change only."
        }
      ],
      "status": "final",
      "version": "3"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c22.3.6",
            "product": {
              "name": "Microsoft Defender for IoT \u003c22.3.6",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "22.3.6",
            "product": {
              "name": "Microsoft Defender for IoT 22.3.6",
              "product_id": "11967"
            }
          }
        ],
        "category": "product_name",
        "name": "Microsoft Defender for IoT"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-23379",
      "cwe": {
        "id": "CWE-23",
        "name": "Relative Path Traversal"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "You need to update to the latest Microsoft Defender for IoT software version. See the Update the software version section of Manage the on-premises management console.\nMicrosoft Defender for IoT is a unified security solution for identifying IoT/OT devices, vulnerabilities, and threats. It enables you to secure your entire IoT/OT environment, whether you need to protect existing IoT/OT devices or build security into new IoT innovations. See Microsoft Defender for IoT for more information.",
          "title": "What is the action required to take the update?"
        },
        {
          "category": "faq",
          "text": "An attacker must be an authenticated user logged in on the targeted Defender for IOT Management Console in order to exploit this vulnerability.",
          "title": "According to the CVSS metric, the attack vector is local (AV:L). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could gain administrator privileges.",
          "title": "What privileges could be gained by an attacker who successfully exploited the vulnerability?"
        },
        {
          "category": "faq",
          "text": "An attacker must authenticate and be assigned the role of a Security Analyst or Administrator to exploit this vulnerability.",
          "title": "According to the CVSS metric, privileges required is low (PR:L).  What does that mean for this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "11967"
        ],
        "known_affected": [
          "1"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-23379 Microsoft Defender for IoT Elevation of Privilege Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379"
        },
        {
          "category": "self",
          "summary": "CVE-2023-23379 Microsoft Defender for IoT Elevation of Privilege Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23379"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-02-14T08:00:00.000Z",
          "details": "22.3.6:Security Update:https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes#versions-223x",
          "product_ids": [
            "1"
          ],
          "url": "https://learn.microsoft.com/en-us/azure/defender-for-iot/organizations/release-notes#versions-223x"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "LOW",
            "attackVector": "LOCAL",
            "availabilityImpact": "HIGH",
            "baseScore": 7.8,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "HIGH",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "LOW",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "UNCHANGED",
            "temporalScore": 6.8,
            "userInteraction": "NONE",
            "vectorString": "CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Elevation of Privilege"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Microsoft Defender for IoT Elevation of Privilege Vulnerability"
    }
  ]
}