Spoofing attack in Microsoft OneNote



| Updated: 2024-10-25
Risk Medium
Patch available YES
Number of vulnerabilities 1
CVE-ID CVE-2023-33140
CWE-ID CWE-451
Exploitation vector Network
Public exploit Public exploit code for vulnerability #1 is available.
Vulnerable software
 OneNote for Universal
Other software / Other software solutions

Vendor Microsoft

Security Bulletin

This security bulletin contains one medium risk vulnerability.

1) Spoofing attack

EUVDB-ID: #VU77271

Risk: Medium

CVSSv3.1: 5.9 [CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C]

CVE-ID: CVE-2023-33140

CWE-ID: CWE-451 - User Interface (UI) Misrepresentation of Critical Information (Clickjacking, spoofing)

Exploit availability: Yes

Description

The vulnerability allows a remote attacker to perform spoofing attack.

The vulnerability exists due to incorrect processing of user-supplied data in Microsoft OneNote. A remote attacker can trick a victim to open a specially crafted file and spoof page content.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

OneNote for Universal: All versions

CPE2.3 External links

http://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2023-33140


Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.



###SIDEBAR###