Vulnerability identifier: #VU73511

Vulnerability risk: Critical

CVSSv3.1: 7.2 [CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:N/E:H/RL:O/RC:C]

CVE-ID: CVE-2023-23397

CWE-ID: CWE-200

Exploitation vector: Network

Exploits in database: 5

• December 19, 2023
  • CVE-2023-23397 (This script exploits CVE-2023-23397, a Zero-Day vulnerability in Microsoft Outlook, allowing the generation of malicious emails for testing and educational purposes.) [Github]
• June 27, 2023
  • CVE-2023-23397 (Simple PoC in PowerShell for CVE-2023-23397) [Github]
• March 18, 2023
  • CVE-2023-23397_EXPLOIT (Generates meeting requests taking advantage of CVE-2023-23397. This requires the outlook thick client to send.) [Github]
• March 17, 2023
  • CVE-2023-23397-POC (Exploit POC for CVE-2023-23397) [Github]
• March 16, 2023
  • CVE-2023-23397_EXPLOIT_0DAY (Exploit for the CVE-2023-23397) [Github]

Impact: Information disclosure

Vulnerable software:
Microsoft Outlook
Client/Desktop applications / Office applications
Microsoft Office
Client/Desktop applications / Office applications

Vendor: Microsoft