Main Vulnerability Database Vulnerabilities #VU73573

Input validation error in Microsoft products - CVE-2023-23399

Published: March 14, 2023 / Updated: October 25, 2024

Vulnerability identifier: #VU73573

CSH Severity: High

CVSS v4: 8.4 [CVSS:4.0/AV:L/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2023-23399

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: Public exploit is available

Vulnerability details

The vulnerability allows a remote attacker to execute arbitrary code on the system.

The vulnerability exists due to insufficient validation of user-supplied input in Microsoft Excel. A remote attacker can pass specially crafted input to the application and execute arbitrary code on the target system.

Affected software

Office Online Server
Microsoft Office LTSC
Microsoft 365 Apps for Enterprise
Microsoft Office
Microsoft Excel
Microsoft Office Web Apps Server

How to mitigate CVE-2023-23399

Install updates from vendor's website.

Links to Public Exploits and PoC-codes

Exploit #10727 - Microsoft Excel 365 MSO (Version 2302 Build 16.0.16130.20186) 64-bit - Remote Code Execution (RCE) (October 25, 2024)

External References

https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23399

Related Security Bulletins

Multiple vulnerabilities in Microsoft Excel