Spoofing attack in Microsoft products - CVE-2023-36897
Published: August 8, 2023 / Updated: August 10, 2023
Vulnerability identifier: #VU79180
CSH Severity: High
CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2023-36897
CWE-ID: CWE-451
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to perform spoofing attack.
The vulnerability exists due to incorrect processing of user-supplied data in Visual Studio Tools for Office. A remote attacker can spoof page content.
Affected software
Visual Studio 2010 Tools for Office Runtime
Visual Studio
Microsoft Office LTSC
Microsoft 365 Apps for Enterprise
Microsoft Office
Visual Studio
Microsoft Office LTSC
Microsoft 365 Apps for Enterprise
Microsoft Office
How to mitigate CVE-2023-36897
Install updates from vendor's website.
Visual Studio - addressed in versions 17.2.18 17.2.33927.290, 17.4.10 17.4.33927.135, 17.6.6 17.6.33927.249