by Kastro
Paper/Archive/CVE-2023-21716

CVE-2023-21716

Microsoft Microsoft 365 Apps for Enterprise — Microsoft Word Remote Code Execution Vulnerability

EPSS 85%CVSS 9.8
critical.is priorityof 100
49
CVSS 9.8 (NVD, CNA agree)9.8 / 10 × 3029.4Not in CISA KEV+300.0EPSS percentile 99.7.997 × 2019.9No public exploit+100.0SSVC exploitation: none+100.0
Description · from the CVE record

Microsoft Word Remote Code Execution Vulnerability

Affected

ProductAffectedFixed inSource
Microsoft 365 Apps for Enterprise16.0.1 – < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleasesCNA
Microsoft Office 201919.0.0 – < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleasesCNA
Microsoft Office 2019 for Mac16.0.0 – < 16.70.2302120116.70.23021201CNA
Microsoft Office LTSC 202116.0.1 – < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleasesCNA
Microsoft Office LTSC for Mac 202116.0.1 – < 16.70.2302120116.70.23021201CNA
Microsoft Office Online Server16.0.1 – < 16.0.10395.2000116.0.10395.20001CNA
Microsoft Office Web Apps Server 2013 Service Pack 115.0.1 – < 15.0.5529.100015.0.5529.1000CNA
Microsoft SharePoint Enterprise Server 2013 Service Pack 115.0.0 – < 15.0.5529.100015.0.5529.1000CNA
Microsoft SharePoint Enterprise Server 201616.0.0 – < 16.0.5383.100016.0.5383.1000CNA
Microsoft SharePoint Foundation 2013 Service Pack 115.0.0 – < 15.0.5529.100015.0.5529.1000CNA
Microsoft SharePoint Server 201916.0.0 – < 16.0.10395.2000116.0.10395.20001CNA
Microsoft SharePoint Server Subscription Edition16.0.0 – < 16.0.15601.2047816.0.15601.20478CNA

Scores by source

microsoft (CNA)9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
NVD9.8CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
CISA ADPSSVCExploitation: none · Automatable: yes · Technical impact: total

References

patchmsrc.microsoft.com/update-guide/vulnerability/CVE-2023-21716