{"@odata.context":"https://api.msrc.microsoft.com/sug/v2.0/sugodata/v2.0/en-US/$metadata#vulnerability/$entity","id":"00000000-0000-0000-0000-00009b0fee9f","releaseDate":"2023-03-14T07:00:00Z","cveNumber":"CVE-2023-23397","cveTitle":"Microsoft Outlook Elevation of Privilege Vulnerability","releaseNumber":"2023-Mar","vulnType":"Security Vulnerability","latestRevisionDate":"2023-03-21T07:00:00Z","cweList":["CWE-20: Improper Input Validation"],"cweDetailsListForSearch":[],"mitreText":"CVE-2023-23397","mitreUrl":"https://www.cve.org/CVERecord?id=CVE-2023-23397","publiclyDisclosed":"No","exploited":"Yes","latestSoftwareReleaseId":0,"latestSoftwareRelease":"Exploitation Detected","olderSoftwareReleaseId":0,"denialOfService":"N/A","tag":"Microsoft Office Outlook","issuingCna":"Microsoft","issuingCnaId":0,"severityId":100000000,"severity":"Critical","impactId":100000002,"impact":"Elevation of Privilege","langCode":"en-US","baseScore":"9.8","temporalScore":"9.1","vectorString":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:F/RL:O/RC:C","vectorStringSource":"Microsoft","isMariner":false,"customerActionRequired":true,"customerActionRequiredId":0,"cweDetailsList":[{"keys":["cwe","cweUrl"],"values":["CWE-20: Improper Input Validation","https://cwe.mitre.org/data/definitions/20.html"]}],"articles":[{"articleType":"FAQ","description":"<p><strong>According to the CVSS metrics, successful exploitation of this vulnerability could lead to major loss of confidentiality (C:H), integrity (I:H) and availability (A:H). What does that mean for this vulnerability?</strong></p>\n<p>An attacker who successfully exploited this vulnerability could access a user's Net-NTLMv2 hash which could be used as a basis of an NTLM Relay attack against another service to authenticate as the user.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>Is the Preview Pane an attack vector for this vulnerability?</strong></p>\n<p>The attacker could exploit this vulnerability by sending a specially crafted email which triggers automatically when it is retrieved and processed by the Outlook client. This could lead to exploitation BEFORE the email is viewed in the Preview Pane.</p>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>How could an attacker exploit this vulnerability?</strong></p>\n<p>External attackers could send specially crafted emails that will cause a connection from the victim to an untrusted\u00a0location of attackers' control. This will leak the Net-NTLMv2 hash of the victim to the untrusted network which an attacker can then relay to another service and authenticate as the victim.</p>\n","ordinal":10000},{"articleType":"Mitigation","description":"<p><strong>The following <a href=\"https://technet.microsoft.com/library/security/dn848375.aspx\">mitigating factors</a> may be helpful in your situation:</strong></p>\n<ul>\n<li>Add users to the Protected Users Security Group, which prevents the use of NTLM as an authentication mechanism. Performing this mitigation makes troubleshooting easier than other methods of disabling NTLM.  Consider using it for high value accounts such as Domain Admins when possible.   <strong>Please note:</strong> This may cause impact to applications that require NTLM, however the settings will revert once the user is removed from the Protected Users Group. Please see <a href=\"https://learn.microsoft.com/en-us/windows-server/security/credentials-protection-and-management/protected-users-security-group\">Protected Users Security Group</a> for more information.</li>\n<li>Block TCP 445/SMB outbound from your network by using a perimeter firewall, a local firewall, and via your VPN settings.  This will prevent the sending of NTLM authentication messages to remote file shares.</li>\n</ul>\n","ordinal":10000},{"articleType":"FAQ","description":"<p><strong>Where can I find more information about NTLM relay attacks?</strong></p>\n<p>Download <a href=\"https://www.microsoft.com/en-us/download/details.aspx?id=36036\">Mitigating Pass the Hash (PtH) Attacks and Other Credential Theft, Version 1 and 2</a>.  This document discusses Pass-the-Hash (PtH) attacks against the Windows operating systems and provides holistic planning strategies that, when combined with the Windows security features, will provide a more effective defense against pass-the-hash attacks.</p>\n","ordinal":10000},{"title":"FAQ-Where to find more info-CVE-2023-23397","articleType":"FAQ","description":"<p><strong>Where can I find more information?</strong></p>\n<p>Please see the MSRC Blog Post relating to this vulnerability here: <a href=\"https://msrc.microsoft.com/blog/2023/03/microsoft-mitigates-outlook-elevation-of-privilege-vulnerability/\">Microsoft Mitigates Outlook Elevation of Privilege Vulnerability</a>.</p>\n","ordinal":10000}],"revisions":[{"cveNumber":"CVE-2023-23397","version":1,"revisionDate":"2023-03-14T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"<p>Information published.</p>\n","unformattedDescription":"Information published.","notificationNeeded":false,"notificationSent":false,"sourceId":"1c871e5e-66ad-ed11-9327-000d3ac5fb71"},{"cveNumber":"CVE-2023-23397","version":1.1,"revisionDate":"2023-03-15T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"<p>Updated acknowledgment.</p>\n","unformattedDescription":"Updated acknowledgment.","notificationNeeded":false,"notificationSent":false,"sourceId":"90094dd6-57c3-ed11-9328-000d3ac5fb71"},{"cveNumber":"CVE-2023-23397","version":1.2,"revisionDate":"2023-03-16T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"<p>Removed the mitigation guidance which recommended disabling the web client service as it is not applicable.</p>\n","unformattedDescription":"Removed the mitigation guidance which recommended disabling the web client service as it is not applicable.","notificationNeeded":false,"notificationSent":false,"sourceId":"4a1820b1-5cc4-ed11-9329-000d3ac5fb71"},{"cveNumber":"CVE-2023-23397","version":1.3,"revisionDate":"2023-03-21T07:00:00Z","initialDate":"0001-01-01T00:00:00Z","description":"<p>Updated FAQ information. This is an informational change only.</p>\n","unformattedDescription":"Updated FAQ information. This is an informational change only.","notificationNeeded":false,"notificationSent":false,"sourceId":"aaaf406f-51c8-ed11-9329-000d3ac5fb71"}]}