# CVE-2023-23397: Microsoft Outlook 2013 - Privilege Escalation

> Live exploitation tracking for CVE-2023-23397 by the CrowdSec Live Exploit Tracker, built from real-world attack data crowdsourced from CrowdSec's global network.

Page: https://tracker.crowdsec.net/cves/CVE-2023-23397

## Key facts

- **Exploitation phase:** Limited Exploitation. The vulnerability is known but shows very limited attacker interest or exploitation activity.
- **CVSS score:** 9.8
- **Public exploit available:** Yes
- **Affected products:** Microsoft Outlook 2013 Service Pack 1
- **Weaknesses:** CWE-294 (Authentication Bypass by Capture-replay); CWE-20 (Improper Input Validation)
- **Tags:** windows

## Description

Microsoft Outlook Elevation of Privilege Vulnerability

## CrowdSec analysis

[CVE-2023-23397](https://euvd.enisa.europa.eu/vulnerability/CVE-2023-23397) is a vulnerability in Microsoft Outlook that allows an attacker to elevate privileges by sending a specially crafted email.

CrowdSec has been tracking this vulnerability and its exploits since 31st of March 2023.

CrowdSec has not observed any significant exploitation activity targeting CVE-2023-23397 across its network. As a result, no community-driven trend analysis is available for this vulnerability at this time.

This vulnerability is exploited by sending a specially crafted email to the target user containing an extended MAPI property with a UNC path to an SMB share controlled by the attacker. When Outlook queries the share, the attacker can then relay the credentials to authenticate against other systems supporting NTLM authentication.

## Timeline

- 2023-03-14: CVE Published. CVE-2023-23397 is published to NVD.
- 2023-03-14: CISA KEV. CVE-2023-23397 is added to the Known Exploited Vulnerabilities catalog by CISA.
- 2023-03-31: Rule Released. CrowdSec releases a rule to detect CVE-2023-23397 exploitation attempts against the CrowdSec Network.
- 2023-04-04: CISA Remediation Deadline. Expiration of the CISA remediation deadline as described in [BOD 22-01](https://www.cisa.gov/news-events/directives/bod-22-01-reducing-significant-risk-known-exploited-vulnerabilities).
- 2026-09-21: CrowdSec First Seen. CrowdSec observes in-the-wild exploitation of CVE-2023-23397 for the first time.

## References

- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397

## Live exploitation data

The [Live Exploit Tracker page](https://tracker.crowdsec.net/cves/CVE-2023-23397) follows observed exploitation activity for CVE-2023-23397. [Request an API key](https://tracker.crowdsec.net/request-api-key) for full access to its exploitation timeline, attacking IP addresses and blocklists.