Microsoft Outlook 2013 - Privilege Escalation (CVE-2023-23397)
Description
Microsoft Outlook Elevation of Privilege Vulnerability
psychologyCrowdSec Analysis
CVE-2023-23397 is a vulnerability in Microsoft Outlook that allows an attacker to elevate privileges by sending a specially crafted email.
CrowdSec has been tracking this vulnerability and its exploits since 31st of March 2023.
CrowdSec has not observed any significant exploitation activity targeting CVE-2023-23397 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.
This vulnerability is exploited by sending a specially crafted email to the target user containing an extended MAPI property with a UNC path to an SMB share controlled by the attacker. When Outlook queries the share, the attacker can then relay the credentials to authenticate against other systems supporting NTLM authentication.
Full Intelligence Available
Connect your API key to access CrowdSec scores, exploit timelines, and attacker IPs.
| Event | Date |
|---|---|
| CVE Published | 2023-03-14 |
| CISA KEV | 2023-03-14 |
| Rule Released | 2023-03-31 |
| CISA Remediation Deadline | 2023-04-04 |
| CrowdSec First Seen | 2026-09-21 |
Related Weaknesses
A capture-replay flaw exists when the design of the product makes it possible for a malicious user to sniff network traffic and bypass authentication by replaying it to the server in question to the same effect as the original message (or with minor changes).
The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.