Skip to main content
Category

Patch Tuesday

Microsoft Patch Tuesday Update | September 2023

By Patch Management, Patch Tuesday, Video, Webinars

Watch September’s Microsoft Patch Tuesday Forecast On Demand

Dive into this month’s bulletins and strategies for tackling the latest and most important Patch Tuesday updates.  Syxsense’s Chief Customer Success Officer, Rob Brown, covers all of the latest updates live.

Watch the Webinar

syxsense - patch management, cybersecurity, mobile device management, security scanning, remediation

Hosted by Rob Brown, Chief Customer Success Officer

During his 17 years at Syxsense, Rob’s role has evolved from onsite technical consultant through providing solutions around Patch Management, Vulnerability Management and Security Best Practices. His team have deployed over 100M patches to our global customers over the last decade.

September 13, 2023
Love0

September 2023 Patch Tuesday: Microsoft releases 59 fixes this month including 2 Critical and 2 Weaponised Threats

By Blog, Patch Management, Patch Tuesday

Microsoft releases 59 fixes this month including 2 Critical and 2 Weaponised Threats

There are 2 Critical, 55 Important, 1 Moderate and an NA severity fixed this month.  Microsoft Windows and Windows Components, Exchange Server, Office, .NET and Visual Studio, Azure, Microsoft Dynamics and Windows Defender have all received fixes this month.

Robert Brown, Head of Customer Success for Syxsense said, “We have 2 patches that resolve vulnerabilities which are Weaponised and one of those are also Publicly Aware. If you count all the individual CVSS scores together, September has a combined CVSS score of 434.3 down from 531.5 last month; however, the average CVSS score was 7.4 which was higher than last month’s even though there were a larger quantity of updates which were fixed.”

Based on the Vendor Severity & CVSS Score, we have made a few recommendations below.  As usual we recommend our customers enter the CVE numbers below into your Patch Management solution and deploy as soon as testing is complete.

 

CVE-2023-36761 – Microsoft Word Information Disclosure Vulnerability

Exploiting this vulnerability could allow the disclosure of NTLM hashes, the Preview Pane is an attack vector.

Note:  The vulnerability is Weaponised and Publicly Aware

Syxscore

  • Vendor Severity: Important
  • CVSS: 6.2
  • Weaponised: Yes
  • Public Aware: Yes
  • Countermeasure: No

Risk

  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope / Jump Point: Unchanged / No

CVE-2023-36802 – Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability

This vulnerability has been found by the Microsoft Threat Intelligence team and could be linked to an existing Ransomware attack.  An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

Note:  The vulnerability is Weaponised

Syxscore

  • Vendor Severity: Important
  • CVSS: 7.8
  • Weaponised: Yes
  • Public Aware: No
  • Countermeasure: No

Risk

  • Attack Vector: Local
  • Attack Complexity: Low
  • Privileges Required: Low
  • User Interaction: None
  • Scope / Jump Point: Unchanged / No

CVE-2023-38148 – Internet Connection Sharing (ICS) Remote Code Execution Vulnerability

An unauthorized attacker could exploit this Internet Connection Sharing (ICS) vulnerability by sending a specially crafted network packet to the Internet Connection Sharing (ICS) Service.

Note:  The vulnerability is More Likely to be Weaponised

Syxscore

  • Vendor Severity: Critical
  • CVSS: 8.8
  • Weaponised: No
  • Public Aware: No
  • Countermeasure: No

Risk

  • Attack Vector: Adjacent
  • Attack Complexity: Low
  • Privileges Required: None
  • User Interaction: None
  • Scope / Jump Point: Unchanged / No
Reference Description Vendor Severity CVSS Score Weaponised Publicly Aware Additional Information Countermeasure Exploitability Assessment Impact
CVE-2023-36761 Microsoft Word Information Disclosure Vulnerability Important 6.2 Yes Yes Exploiting this vulnerability could allow the disclosure of NTLM hashes, the Preview Pane is an attack vector. No Exploitation Detected Information Disclosure
CVE-2023-36802 Microsoft Streaming Service Proxy Elevation of Privilege Vulnerability Important 7.8 Yes No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation Detected Elevation of Privilege
CVE-2023-38148 Internet Connection Sharing (ICS) Remote Code Execution Vulnerability Critical 8.8 No No Yes Exploitation More Likely Remote Code Execution
CVE-2023-33136 Azure DevOps Server Remote Code Execution Vulnerability Important 8.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36764 Microsoft SharePoint Server Elevation of Privilege Vulnerability Important 8.8 No No An attacker who successfully exploited this vulnerability could gain administrator privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-38146 Windows Themes Remote Code Execution Vulnerability Important 8.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-38147 Windows Miracast Wireless Display Remote Code Execution Vulnerability Important 8.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36744 Microsoft Exchange Server Remote Code Execution Vulnerability Important 8 No No An attacker could exploit the vulnerability by leveraging the known (Type 4) UnitySerializationHolder gadget through a deserialization of untrusted data. Exploitation of this vulnerability requires that a user gain LAN-access as well as obtain credentials for a valid Exchange user. No Exploitation More Likely Remote Code Execution
CVE-2023-36745 Microsoft Exchange Server Remote Code Execution Vulnerability Important 8 No No An attacker could exploit the vulnerability by leveraging the known (Type 4) UnitySerializationHolder gadget through a deserialization of untrusted data. Exploitation of this vulnerability requires that a user gain LAN-access as well as obtain credentials for a valid Exchange user. No Exploitation More Likely Remote Code Execution
CVE-2023-36757 Microsoft Exchange Server Spoofing Vulnerability Important 8 No No No Exploitation Less Likely Spoofing
CVE-2023-36756 Microsoft Exchange Server Remote Code Execution Vulnerability None 8 No No In a network-based attack, an attacker could trigger malicious code in the context of the server’s account through a network call. No Exploitation More Likely Not a Vulnerability
CVE-2023-35355 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-36739 3D Viewer Remote Code Execution Vulnerability Important 7.8 No No This vulnerability affects FBX component used within the 3D Viewer product. No Exploitation Unlikely Remote Code Execution
CVE-2023-36740 3D Viewer Remote Code Execution Vulnerability Important 7.8 No No This vulnerability affects FBX component used within the 3D Viewer product. No Exploitation Unlikely Remote Code Execution
CVE-2023-36742 Visual Studio Code Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36758 Visual Studio Elevation of Privilege Vulnerability Important 7.8 No No A domain user could use this vulnerability to elevate privileges to SYSTEM assigned integrity level. No Exploitation Less Likely Elevation of Privilege
CVE-2023-36760 3D Viewer Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36765 Microsoft Office Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-36766 Microsoft Excel Information Disclosure Vulnerability Important 7.8 No No No Exploitation Less Likely Information Disclosure
CVE-2023-36770 3D Builder Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36771 3D Builder Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36772 3D Builder Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36773 3D Builder Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36788 .NET Framework Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36792 Visual Studio Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36793 Visual Studio Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36794 Visual Studio Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36796 Visual Studio Remote Code Execution Vulnerability Important 7.8 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36804 Windows GDI Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation More Likely Elevation of Privilege
CVE-2023-38139 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-38141 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-38142 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation More Likely Elevation of Privilege
CVE-2023-38143 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation More Likely Elevation of Privilege
CVE-2023-38144 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation More Likely Elevation of Privilege
CVE-2023-38150 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Exploitation Less Likely Elevation of Privilege
CVE-2023-38161 Windows GDI Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. No Exploitation More Likely Elevation of Privilege
CVE-2023-38163 Windows Defender Attack Surface Reduction Security Feature Bypass Important 7.8 No No No Exploitation Less Likely Security Feature Bypass
CVE-2023-36800 Dynamics Finance and Operations Cross-site Scripting Vulnerability Important 7.6 No No No Exploitation Less Likely Spoofing
CVE-2023-36886 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important 7.6 No No Scope = Changed, Jump Point = True
The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.		 No Exploitation Less Likely Spoofing
CVE-2023-38164 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important 7.6 No No Scope = Changed, Jump Point = True
The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.		 No Exploitation Less Likely Spoofing
CVE-2023-29332 Microsoft Azure Kubernetes Service Elevation of Privilege Vulnerability Critical 7.5 No No An attacker who successfully exploited this vulnerability could gain Cluster Administrator privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-36763 Microsoft Outlook Information Disclosure Vulnerability Important 7.5 No No Exploiting this vulnerability could allow the disclosure of credentials. No Exploitation Less Likely Information Disclosure
CVE-2023-38149 Windows TCP/IP Denial of Service Vulnerability Important 7.5 No No Yes Exploitation Less Likely Denial of Service
CVE-2023-38162 DHCP Server Service Denial of Service Vulnerability Important 7.5 No No Customers who have not configured their DHCP server as a failover are not affected by this vulnerability. Exploitation Less Likely Denial of Service
CVE-2023-36762 Microsoft Word Remote Code Execution Vulnerability Important 7.3 No No The attachment Preview Pane that is accessed when a user clicks to preview an attached file is an attack vector; however, the email Preview Pane itself is not. No Exploitation Unlikely Remote Code Execution
CVE-2023-38156 Azure HDInsight Apache Ambari Elevation of Privilege Vulnerability Important 7.2 No No An attacker who successfully exploited this vulnerability could gain domain administrator privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-36805 Windows MSHTML Platform Security Feature Bypass Vulnerability Important 7 No No An attacker who successfully exploited this vulnerability could maintain high privileges, which include read, write, and delete functionality. No Exploitation Less Likely Remote Code Execution
CVE-2023-38155 Azure DevOps Server and Team Foundation Server Elevation of Privilege Vulnerability Important 7 No No An attacker who successfully exploited this vulnerability could gain administrator privileges. No Exploitation Less Likely Elevation of Privilege
CVE-2023-36759 Visual Studio Elevation of Privilege Vulnerability Important 6.7 No No A domain user could use this vulnerability to elevate privileges to SYSTEM assigned integrity level. No Exploitation Less Likely Denial of Service
CVE-2023-36799 .NET Core and Visual Studio Denial of Service Vulnerability Important 6.5 No No No Exploitation Less Likely Denial of Service
CVE-2023-36777 Microsoft Exchange Server Information Disclosure Vulnerability Important 5.7 No No No Exploitation More Likely Information Disclosure
CVE-2023-36803 Windows Kernel Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. No Exploitation Less Likely Information Disclosure
CVE-2023-38140 Windows Kernel Information Disclosure Vulnerability Important 5.5 No No No Exploitation Less Likely Information Disclosure
CVE-2023-38160 Windows TCP/IP Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. No Exploitation More Likely Information Disclosure
CVE-2023-36801 DHCP Server Service Information Disclosure Vulnerability Important 5.3 No No Exploiting this vulnerability could allow the disclosure of initialized or uninitialized memory in the process heap. Yes Exploitation Less Likely Information Disclosure
CVE-2023-38152 DHCP Server Service Information Disclosure Vulnerability Important 5.3 No No Exploiting this vulnerability could allow the disclosure of initialized or uninitialized memory in the process heap. Yes Exploitation More Likely Information Disclosure
CVE-2023-36736 Microsoft Identity Linux Broker Arbitrary Code Execution Vulnerability Important 4.4 No No No Exploitation Less Likely Remote Code Execution
CVE-2023-36767 Microsoft Office Security Feature Bypass Vulnerability Important 4.3 No No No Exploitation Less Likely Security Feature Bypass
CVE-2023-41764 Microsoft Office Spoofing Vulnerability Moderate No No No Exploitation Less Likely Spoofing
Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
September 12, 2023
Love0

August 2023 Third-Party Roundup Webinar

By Patch Management, Patch Tuesday, Video, Webinars

Don’t miss out on August’s 3rd Party Patch Management Update.

Fill out the form to the right to watch as we dive into August’s bulletins and show you strategies for tackling the latest and most important 3rd Party Patch updates. Our IT industry expert, Jon Cassell, Syxsense’s Senior Solutions Architect, covers all of the latest updates.

Syxsense spots critical threats early and deploys instantly, with curated patch content that includes risk assessment, patch prioritization, and dedicated Patch scheduling for simple deployment every month.

Our experts have deployed over 100 million patches. Join us as we tackle this month’s updates and then get your own customized demo to see how Syxsense can help you manage patches, vulnerabilities, and more.

Watch the Webinar

Jon_Cassell

Hosted By: Jon Cassell, Syxsense Senior Solutions Architect

Jon is currently a Senior Solutions Architect at Syxsense and has been working in the IT and Infrastructure industries for the last 15 years. Before working at Syxsense, he was an IT Manager for a large financial services firm and has a background in Accounting and Tax consultation. He currently holds an MCSA in Server Infrastructure, A+, Network+, Security+, and Server+ certifications.

August 29, 2023
Love0

Microsoft Patch Tuesday Update | August 2023

By Patch Management, Patch Tuesday, Video, Webinars

Watch August’s Microsoft Patch Tuesday Forecast On Demand

Dive into this month’s bulletins and strategies for tackling the latest and most important Patch Tuesday updates.  Syxsense’s Chief Customer Success Officer, Rob Brown, covers all of the latest updates live.

Watch the Webinar

syxsense - patch management, cybersecurity, mobile device management, security scanning, remediation

Hosted by Rob Brown, Chief Customer Success Officer

During his 17 years at Syxsense, Rob’s role has evolved from onsite technical consultant through providing solutions around Patch Management, Vulnerability Management and Security Best Practices. His team have deployed over 100M patches to our global customers over the last decade.

August 9, 2023
Love0

August 2023 Patch Tuesday: Microsoft releases 75 fixes this month including 6 Critical and 4 CVSS Rated over 9.0

By Blog, Patch Management, Patch Tuesday

Microsoft releases 75 fixes this month including 6 Critical and 4 CVSS Rated over 9.0

There are 6 Critical, 67 Important and 2 Moderate severity fixes this month.  Microsoft Windows, Components, Office and Office Components, .NET and Visual Studio, Azure, SQL Server, Exchange, SharePoint & Teams have all received fixes this month.

Robert Brown, Head of Customer Success for Syxsense said, “We have 4 patches that resolve vulnerabilities which have a CVSS score of more than 9 (Critical) and if you count all the individual CVSS scores together, August has a combined CVSS score of 531.5 compared to 861.7 last month.  The average CVSS score was 7.3 which was higher than last month’s even though there were a larger quantity of updates which were fixed.”

Based on the Vendor Severity & CVSS Score, we have made a few recommendations below.  As usual we recommend our customers enter the CVE numbers below into your Patch Management solution and deploy as soon as testing is complete.

ADV230003 – Microsoft Office Defense in Depth Update

This defense in depth update is not a vulnerability, but installing this update stops the attack chain leading to the Windows Search security feature bypass vulnerability (CVE-2023-36884). Microsoft recommends installing this update as well as upgrading to the latest version of Windows.

Note:  The vulnerability is Weaponised.

Syxscore

  • Vendor Severity: Moderate
  • CVSS: TBC
  • Weaponised: Yes
  • Public Aware: Yes
  • Countermeasure: No

CVE-2023-35385 & CVE-2023-36910- Microsoft Message Queuing Remote Code Execution Vulnerability

To exploit this vulnerability, an attacker would need to send a specially crafted malicious MSMQ packet to a MSMQ server. This could result in remote code execution on the server side.

The Windows message queuing service needs to be enabled for a system to be exploitable by this vulnerability. This feature can be added via the Control Panel, you can check to see if there is a service running named Message Queuing and TCP port 1801 is listening on the machine however Successful exploitation of this vulnerability could allow an unauthenticated attacker to remotely execute code on the target server.

Note:  The vulnerability requires a Reboot.

Syxscore

  • Vendor Severity: Critical
  • CVSS: 9.8
  • Weaponised: No
  • Public Aware: No
  • Countermeasure: No

Syxscore Risk

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: None
  • Scope (Jump Point): Unchanged / No

CVE-2023-21709 – Microsoft Exchange Server Elevation of Privilege Vulnerability

In addition to installing the updates a script must also be run.

(Recommended) Install Exchange Server 2016 or 2019 August SU (or later)

Do one of the following:

  1. Apply the solution for the CVE automatically on your servers, run the CVE-2023-21709.ps1 script.
  2. Apply the solution for the CVE manually on each server, by running the following command from an elevated PowerShell window:

Clear-WebConfiguration -Filter “/system.webServer/globalModules/add[@name=’TokenCacheModule’]” -PSPath “IIS:\”

Syxscore

  • Vendor Severity: Important
  • CVSS: 9.8
  • Weaponised: No
  • Public Aware: No
  • Countermeasure: No

Syxscore Risk

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: None
  • Scope (Jump Point): Unchanged / No

Reference

Description

Vendor
Severity

CVSS
Score

Weaponised

Publicly
Aware

Impact

Exploitability
Assessment

Additional
Information

ADV230003

Microsoft Office Defense in Depth Update

Moderate

NA

Yes

Yes

Defense in
Depth

Exploitation
Detected

 This defense in depth update is not a vulnerability, but installing this update stops the attack chain leading to the Windows Search security feature bypass vulnerability (CVE-2023-36884). Microsoft recommends installing this update as well as upgrading to the latest version of Windows.

CVE-2023-38180

.NET and Visual Studio Denial of Service Vulnerability

Important

7.5

Yes

No

Denial of
Service

Exploitation
Less Likely

ADV230004

Memory Integrity System Readiness Scan Tool Defense in Depth Update

Moderate

NA

No

Yes

Defense in
Depth

Exploitation
More Likely

 Detect compatibility issues with memory integrity (also known as hypervisor-protected code integrity (HVCI)). The memory integrity scan tool is available to download on Windows 10, Windows 11, and Windows Server machines.

CVE-2023-35385

Microsoft Message Queuing Remote Code Execution Vulnerability

Critical

9.8

No

No

Remote Code
Execution

Exploitation
Less Likely

 The Windows message queuing service, which is a Windows component, needs to be enabled for a system to be exploitable by this vulnerability. This feature can be added via the Control Panel.You can check to see if there is a service running named Message Queuing and TCP port 1801 is listening on the machine.

CVE-2023-36910

Microsoft Message Queuing Remote Code Execution Vulnerability

Critical

9.8

No

No

Remote Code
Execution

Exploitation
Less Likely

 To exploit this vulnerability, an attacker would need to send a specially crafted malicious MSMQ packet to a MSMQ server. This could result in remote code execution on the server side.The Windows message queuing service, which is a Windows component, needs to be enabled for a system to be exploitable by this vulnerability. This feature can be added via the Control Panel.You can check to see if there is a service running named Message Queuing and TCP port 1801 is listening on the machine.

CVE-2023-36911

Microsoft Message Queuing Remote Code Execution Vulnerability

Critical

9.8

No

No

Remote Code
Execution

Exploitation
Less Likely

 Successful exploitation of this vulnerability could allow an unauthenticated attacker to remotely execute code on the target server.The Windows message queuing service, which is a Windows component, needs to be enabled for a system to be exploitable by this vulnerability. This feature can be added via the Control Panel.You can check to see if there is a service running named Message Queuing and TCP port 1801 is listening on the machine.

CVE-2023-21709

Microsoft Exchange Server Elevation of Privilege Vulnerability

Important

9.8

No

No

Elevation of
Privilege

Exploitation
Less Likely

 In addition to installing the updates a script must be run.  Alternatively, you can accomplish the same by running commands from the command line in a PowerShell window or some other terminal.Follow the following steps:(Recommended) Install Exchange Server 2016 or 2019 August SU (or later)Do one of the following:1. Apply the solution for the CVE automatically on your servers, run the CVE-2023-21709.ps1 script.2. Apply the solution for the CVE manually on each server, by running the following command from an elevated PowerShell window:Clear-WebConfiguration -Filter “/system.webServer/globalModules/add[@name=’TokenCacheModule’]” -PSPath “IIS:\”

CVE-2023-29328

Microsoft Teams Remote Code Execution Vulnerability

Critical

8.8

No

No

Remote Code
Execution

Exploitation
Less Likely

 Successful exploitation could potentially cause downtime for the client machine.

CVE-2023-29330

Microsoft Teams Remote Code Execution Vulnerability

Critical

8.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-35368

Microsoft Exchange Remote Code Execution Vulnerability

Important

8.8

No

No

Remote Code
Execution

Exploitation
Less Likely

 Successful exploitation of this vulnerability could allow an attacker the ability to gain remote code execution via an in-network attacker calling arbitrary endpoints.

CVE-2023-35381

Windows Fax Service Remote Code Execution Vulnerability

Important

8.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-35387

Windows Bluetooth A2DP driver Elevation of Privilege Vulnerability

Important

8.8

No

No

Elevation of
Privilege

Exploitation
Less Likely

 Scope = Changed, Jump Point = TrueAn authorized attacker could exploit the Windows Bluetooth driver vulnerability by programmatically running certain functions that could lead to elevation of privilege on the Bluetooth component.

CVE-2023-38169

Microsoft OLE DB Remote Code Execution Vulnerability

Important

8.8

No

No

Remote Code
Execution

Exploitation
Less Likely

 An attacker could exploit the vulnerability by tricking an authenticated user into attempting to connect to a malicious SQL server via OLEDB, which could result in the server receiving a malicious networking packet. This could allow the attacker to execute code remotely on the client.

CVE-2023-38181

Microsoft Exchange Server Spoofing Vulnerability

Important

8.8

No

No

Spoofing

Exploitation
Less Likely

 An authenticated attacker could achieve exploitation given a PowerShell remoting session to the server.

CVE-2023-38185

Microsoft Exchange Server Remote Code Execution Vulnerability

Important

8.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-36897

Visual Studio Tools for Office Runtime Spoofing Vulnerability

Important

8.1

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-35388

Microsoft Exchange Server Remote Code Execution Vulnerability

Important

8.0

No

No

Remote Code
Execution

Exploitation
More Likely

 An authenticated attacker could gain remote code execution rights on the server mailbox backend as NT AUTHORITY\SYSTEM.

CVE-2023-36891

Microsoft SharePoint Server Spoofing Vulnerability

Important

8.0

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-36892

Microsoft SharePoint Server Spoofing Vulnerability

Important

8.0

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-38182

Microsoft Exchange Server Remote Code Execution Vulnerability

Important

8.0

No

No

Remote Code
Execution

Exploitation
More Likely

CVE-2023-36895

Microsoft Outlook Remote Code Execution Vulnerability

Critical

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-35359

Windows Kernel Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
More Likely

 An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2023-35371

Microsoft Office Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-35372

Microsoft Office Visio Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-35379

Reliability Analysis Metrics Calculation Engine (RACEng) Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could gain specific limited SYSTEM privileges.

CVE-2023-35380

Windows Kernel Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
More Likely

CVE-2023-35382

Windows Kernel Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
More Likely

 An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2023-35386

Windows Kernel Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
More Likely

 An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2023-35390

.NET and Visual Studio Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-36865

Microsoft Office Visio Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-36866

Microsoft Office Visio Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-36896

Microsoft Excel Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-36898

Tablet Windows User Interface Application Core Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-36900

Windows Common Log File System Driver Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
More Likely

 An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2023-36903

Windows System Assessment Tool Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could gain specific limited SYSTEM privileges.

CVE-2023-36904

Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could gain specific limited SYSTEM privileges.

CVE-2023-38154

Windows Kernel Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
Unlikely

 An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2023-38170

HEVC Video Extensions Remote Code Execution Vulnerability

Important

7.8

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-38175

Microsoft Windows Defender Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
Less Likely

 Windows Defender Antimalware Platform

CVE-2023-38186

Windows Mobile Device Management Elevation of Privilege Vulnerability

Important

7.8

No

No

Elevation of
Privilege

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2023-35383

Microsoft Message Queuing Information Disclosure Vulnerability

Important

7.5

No

No

Information
Disclosure

Exploitation
Less Likely

 An attacker who successfully exploited the vulnerability could potentially read User Mode Service Memory.

CVE-2023-36899

ASP.NET Elevation of Privilege Vulnerability

Important

7.5

No

No

Elevation of
Privilege

Exploitation
Less Likely

 The attacker would gain the rights of the user that is running the affected application.

CVE-2023-36912

Microsoft Message Queuing Denial of Service Vulnerability

Important

7.5

No

No

Denial of
Service

Exploitation
Less Likely

CVE-2023-38172

Microsoft Message Queuing Denial of Service Vulnerability

Important

7.5

No

No

Denial of
Service

Exploitation
Less Likely

CVE-2023-38178

.NET Core and Visual Studio Denial of Service Vulnerability

Important

7.5

No

No

Denial of
Service

Exploitation
Less Likely

CVE-2023-38184

Windows Lightweight Directory Access Protocol (LDAP) Remote Code Execution Vulnerability

Important

7.5

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-36873

.NET Framework Spoofing Vulnerability

Important

7.4

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-38167

Microsoft Dynamics Business Central Elevation Of Privilege Vulnerability

Important

7.2

No

No

Elevation of
Privilege

Exploitation
Less Likely

 Successful exploitation of this vulnerability requires an attacker to already have admin or high privilege access to a security group within the tenant.

CVE-2023-35391

ASP.NET Core SignalR and Visual Studio Information Disclosure Vulnerability

Important

7.1

No

No

Information
Disclosure

Exploitation
Less Likely

 This vulnerability makes it possible to listen to any group or user with a specially crafted group/username. By exploiting this vulnerability, the attacker can now receive messages for group(s) that they are unauthorized to view.

CVE-2023-36876

Reliability Analysis Metrics Calculation (RacTask) Elevation of Privilege Vulnerability

Important

7.1

No

No

Elevation of
Privilege

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could create or delete files in the security context of the “NT AUTHORITY\ LOCAL SERVICE” account.

CVE-2023-35378

Windows Projected File System Elevation of Privilege Vulnerability

Important

7.0

No

No

Elevation of
Privilege

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could gain SYSTEM privileges.

CVE-2023-38176

Azure Arc-Enabled Servers Elevation of Privilege Vulnerability

Important

7.0

No

No

Elevation of
Privilege

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could gain administrator privileges.

CVE-2023-35376

Microsoft Message Queuing Denial of Service Vulnerability

Important

6.5

No

No

Denial of
Service

Exploitation
Less Likely

CVE-2023-35377

Microsoft Message Queuing Denial of Service Vulnerability

Important

6.5

No

No

Denial of
Service

Exploitation
Less Likely

CVE-2023-35389

Microsoft Dynamics 365 On-Premises Remote Code Execution Vulnerability

Important

6.5

No

No

Remote Code
Execution

Exploitation
Less Likely

 Scope = Changed, Jump Point = True

CVE-2023-36890

Microsoft SharePoint Server Information Disclosure Vulnerability

Important

6.5

No

No

Information
Disclosure

Exploitation
Less Likely

CVE-2023-36893

Microsoft Outlook Spoofing Vulnerability

Important

6.5

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-36894

Microsoft SharePoint Server Information Disclosure Vulnerability

Important

6.5

No

No

Information
Disclosure

Exploitation
Less Likely

 An attacker that successfully exploited this vulnerability could leak private property values.

CVE-2023-36909

Microsoft Message Queuing Denial of Service Vulnerability

Important

6.5

No

No

Denial of
Service

Exploitation
Less Likely

CVE-2023-36913

Microsoft Message Queuing Information Disclosure Vulnerability

Important

6.5

No

No

Information
Disclosure

Exploitation
Less Likely

CVE-2023-38254

Microsoft Message Queuing Denial of Service Vulnerability

Important

6.5

No

No

Denial of
Service

Exploitation
Less Likely

CVE-2023-36869

Azure DevOps Server Spoofing Vulnerability

Important

6.3

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-36908

Windows Hyper-V Information Disclosure Vulnerability

Important

5.7

No

No

Information
Disclosure

Exploitation
Less Likely

CVE-2023-36889

Windows Group Policy Security Feature Bypass Vulnerability

Important

5.5

No

No

Security Feature
Bypass

Exploitation
Less Likely

 An authenticated attacker who successfully exploited this vulnerability could read specific Group Policy configuration settings.

CVE-2023-36905

Windows Wireless Wide Area Network Service (WwanSvc) Information Disclosure Vulnerability

Important

5.5

No

No

Information
Disclosure

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.

CVE-2023-36906

Windows Cryptographic Services Information Disclosure Vulnerability

Important

5.5

No

No

Information
Disclosure

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.

CVE-2023-36907

Windows Cryptographic Services Information Disclosure Vulnerability

Important

5.5

No

No

Information
Disclosure

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory.

CVE-2023-36914

Windows Smart Card Resource Management Server Security Feature Bypass Vulnerability

Important

5.5

No

No

Security Feature
Bypass

Exploitation
Less Likely

 An attacker who successfully exploited this vulnerability could bypass the Fast Identity Online (FIDO) secure authentication feature.

CVE-2023-35384

Windows HTML Platforms Security Feature Bypass Vulnerability

Important

5.4

No

No

Security Feature
Bypass

Exploitation
More Likely

CVE-2023-35394

Azure HDInsight Jupyter Notebook Spoofing Vulnerability

Important

4.6

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-35393

Azure Apache Hive Spoofing Vulnerability

Important

4.5

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-36877

Azure Apache Oozie Spoofing Vulnerability

Important

4.5

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-36881

Azure Apache Ambari Spoofing Vulnerability

Important

4.5

No

No

Spoofing

Exploitation
Less Likely

CVE-2023-36882

Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution Vulnerability

Important

4.5

No

No

Remote Code
Execution

Exploitation
Less Likely

CVE-2023-38188

Azure Apache Hadoop Spoofing Vulnerability

Important

4.5

No

No

Spoofing

Exploitation
Less Likely
Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
August 8, 2023
Love0

July 2023 3rd Party Roundup Webinar

By Patch Management, Patch Tuesday, Video, Webinars

Don’t miss out on July’s powerful 3rd Party Patch Management Update.

Fill out the form to the right to watch as we dive into July’s bulletins and show you strategies for tackling the latest and most important 3rd Party Patch updates. Our IT industry expert, Jon Cassell, Syxsense’s Senior Solutions Architect, covers all of the latest updates.

Syxsense spots critical threats early and deploys instantly, with curated patch content that includes risk assessment, patch prioritization, and dedicated Patch scheduling for simple deployment every month.

Our experts have deployed over 100 million patches. Join us as we tackle this month’s updates and then get your own customized demo to see how Syxsense can help you manage Patch vulnerabilities and more.

Watch the Webinar

Jon_Cassell

Hosted By: Jon Cassell, Syxsense Senior Solutions Architect

Jon is currently a Senior Solutions Architect at Syxsense and has been working in the IT and Infrastructure industries for the last 15 years. Before working at Syxsense, he was an IT Manager for a large financial services firm and has a background in Accounting and Tax consultation. He currently holds an MCSA in Server Infrastructure, A+, Network+, Security+, and Server+ certifications.

July 25, 2023
Love0

Microsoft Patch Tuesday Update | July 2023

By Patch Management, Patch Tuesday, Video, Webinars

Watch July’s Microsoft Patch Tuesday Forecast On Demand

Dive into this month’s bulletins and strategies for tackling the latest and most important Patch Tuesday updates.  Syxsense’s Chief Customer Success Officer, Rob Brown, covers all of the latest updates live.

Watch the Webinar

syxsense - patch management, cybersecurity, mobile device management, security scanning, remediation

Hosted by Rob Brown, Chief Customer Success Officer

During his 17 years at Syxsense, Rob’s role has evolved from onsite technical consultant through providing solutions around Patch Management, Vulnerability Management and Security Best Practices. His team have deployed over 100M patches to our global customers over the last decade.

July 12, 2023
Love0
"zero,Day,Exploit"and,Alert,Icon,On,Display,Of,Computer

Microsoft Office and Windows Zero-Day Fix: Syxsense Security Script Ready to Deploy

By Blog, Patch Management, Patch Tuesday

Microsoft Office and Windows Zero-Day Fix: Syxsense Security Script Ready to Deploy

On top of Microsoft’s Patch Tuesday update yesterday, an out-of-band zero-day vulnerability was released. Tagged as CVE-2023-36884, Microsoft highlighted that this vulnerability impacts Windows and Office users and confirmed that it was investigating multiple reports of targeted code execution specifically using Microsoft Office documents.

At this time, there is no patch available.

Syxsense has created a security script and workflow to remediate the issue with a countermeasure. It is available now for Syxsense Secure users to scan and identify your organizational impact and for Syxsense Enterprise users to scan and deploy the countermeasure immediately. Customers can find the workflow in their Syxsense Cortex library, named “Office and Windows HTML Remote Code Execution Vulnerability” or via its CVE number, CVE-2023-36884.

For additional details on this month’s Patch Tuesday release, including a few vulnerabilities currently being exploited, check out our latest blog post.

Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
July 12, 2023
Love0
July 2023 Patch Tuesday

July 2023 Patch Tuesday: Microsoft releases 130 fixes this month including 10 Critical

By Blog, Patch Management, Patch Tuesday

Microsoft releases 130 fixes this month including 10 Critical and 5 CVSS Rated over 9.0

There are 10 Critical and 120 Important severity fixes this month.  Microsoft Windows, Components, Office and Office Components, .NET and Visual Studio, Azure Active Directory and DevOps, Microsoft Dynamics, Printer Drivers, DNS Server and Remote Desktop have all received fixes this month.

An additional Microsoft zero-day vulnerability was released overnight. More details on that vulnerability and the Syxsense remediation can be found here.

Robert Brown, Head of Customer Success for Syxsense, said, “We have 5 patches that resolve vulnerabilities which have a CVSS score of more than 9 (Critical), and if you count all the individual CVSS scores together, July has a combined CVSS score of 861.7 up from 500.2 last month.  The average CVSS score was 7.2, which indicates a lot of very high profile and important updates were fixed in this release.”

Based on the Vendor Severity & CVSS Score, we have made a few recommendations below.  As usual we recommend our customers enter the CVE numbers below into your Patch Management solution and deploy as soon as testing is complete.

CVE-2023-32049 – Windows SmartScreen Security Feature Bypass Vulnerability
This vulnerability was found by the Microsoft Threat Intelligence team.  The attacker would be able to bypass the Open File – Security Warning prompt.

Note:  The vulnerability is being weaponized.

Syxscore

  • Vendor Severity: Important
  • CVSS: 8.8
  • Weaponized: Yes
  • Public Aware: No
  • Countermeasure: No

Syxscore Risk

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: Required
  • Scope (Jump Point): Unchanged / No

CVE-2023-35311 – Microsoft Outlook Security Feature Bypass Vulnerability
This vulnerability impacts Microsoft Outlook and the user would have to click on a specially crafted URL or email to be compromised by the attacker.  The Preview Pane is an attack vector, but additional user interaction is required.

Note:  The vulnerability is being weaponized.

Syxscore

  • Vendor Severity: Important
  • CVSS: 8.8
  • Weaponized: Yes
  • Public Aware: No
  • Countermeasure: No

Syxscore Risk

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: None
  • User Interaction: Required
  • Scope (Jump Point): Unchanged / No

CVE-2023-33150 – Microsoft Office Security Feature Bypass Vulnerability
In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.  In a web-based attack scenario, an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) containing a specially crafted file designed to exploit the vulnerability.

Note:  The vulnerability has a Jump Point. In this case, successful exploitation of this vulnerability would allow an attacker to escape the Office Protected View.

Syxscore

  • Vendor Severity: Important
  • CVSS: 9.6
  • Weaponized: No
  • Public Aware: No
  • Countermeasure: No

Syxscore Risk

  • Attack Vector: Network
  • Attack Complexity: Low
  • Privileges: Low
  • User Interaction: Required
  • Scope (Jump Point): Changed / Yes
Reference Description Vendor Severity CVSS Score Weaponized Publicly Aware Countermeasure Additional Details Impact Exploitability Assessment
CVE-2023-32049 Windows SmartScreen Security Feature Bypass Vulnerability Important 8.8 Yes No Security Feature Bypass Exploitation Detected
CVE-2023-35311 Microsoft Outlook Security Feature Bypass Vulnerability Important 8.8 Yes No Security Feature Bypass Exploitation Detected
CVE-2023-32046 Windows MSHTML Platform Elevation of Privilege Vulnerability Important 7.8 Yes No Elevation of Privilege Exploitation Detected
CVE-2023-36874 Windows Error Reporting Service Elevation of Privilege Vulnerability Important 7.8 Yes No Elevation of Privilege Exploitation Detected
CVE-2023-33150 Microsoft Office Security Feature Bypass Vulnerability Important 9.6 No No

Scope = Changed, Jump Point = True

Successful exploitation of this vulnerability would allow an attacker to escape the Office Protected View.

 Security Feature Bypass Exploitation Less Likely
CVE-2023-32038 Microsoft ODBC Driver Remote Code Execution Vulnerability Important 8.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-33134 Microsoft SharePoint Server Remote Code Execution Vulnerability Important 8.8 No No Remote Code Execution Exploitation More Likely
CVE-2023-33159 Microsoft SharePoint Server Spoofing Vulnerability Important 8.8 No No Spoofing Exploitation Less Likely
CVE-2023-35300 Remote Procedure Call Runtime Remote Code Execution Vulnerability Important 8.8 No No The authenticated attacker could take advantage of this vulnerability to execute malicious code through the RPC runtime. Remote Code Execution Exploitation Less Likely
CVE-2023-35302 Microsoft PostScript and PCL6 Class Printer Driver Remote Code Execution Vulnerability Important 8.8 No No

Option 1 – Disable the Print Spooler service

If disabling the Print Spooler service is appropriate for your enterprise, use the following PowerShell commands:

Stop-Service -Name Spooler -Force
Set-Service -Name Spooler -StartupType Disabled

Impact of workaround Disabling the Print Spooler service disables the ability to print both locally and remotely.

Option 2 – Disable inbound remote printing through Group Policy

You can also configure the settings via Group Policy as follows:

Computer Configuration / Administrative Templates / Printers

Disable the “Allow Print Spooler to accept client connections:” policy to block remote attacks.

You must restart the Print Spooler service for the group policy to take effect.

 Remote Code Execution Exploitation Less Likely
CVE-2023-35303 USB Audio Class System Driver Remote Code Execution Vulnerability Important 8.8 No No Elevation of Privilege Exploitation Less Likely
CVE-2023-35322 Windows Deployment Services Remote Code Execution Vulnerability Important 8.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35333 MediaWiki PandocUpload Extension Remote Code Execution Vulnerability Important 8.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35364 Windows Kernel Elevation of Privilege Vulnerability Important 8.8 No No

Scope = Changed, Jump Point = True

In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment.

 Elevation of Privilege Exploitation Less Likely
CVE-2023-29347 Windows Admin Center Spoofing Vulnerability Important 8.7 No No

Scope = Changed, Jump Point = True

The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.

 Spoofing Exploitation Less Likely
CVE-2023-33171 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important 8.2 No No

Scope = Changed, Jump Point = True

The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.

 Spoofing Exploitation Less Likely
CVE-2023-35335 Microsoft Dynamics 365 (on-premises) Cross-site Scripting Vulnerability Important 8.2 No No

Scope = Changed, Jump Point = True

The vulnerability is in the web server, but the malicious scripts execute in the victim’s browser on their machine.

 Spoofing Exploitation Less Likely
CVE-2023-33127 .NET and Visual Studio Elevation of Privilege Vulnerability Important 8.1 No No Elevation of Privilege Exploitation Less Likely
CVE-2023-33170 ASP.NET and Visual Studio Security Feature Bypass Vulnerability Important 8.1 No No Security Feature Bypass Exploitation Less Likely
CVE-2023-21756 Windows Win32k Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-32047 Paint 3D Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Unlikely
CVE-2023-32051 Raw Image Extension Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-32053 Windows Installer Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-32056 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-33148 Microsoft Office Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could execute RPC functions that are restricted to local clients only. Elevation of Privilege Exploitation Less Likely
CVE-2023-33149 Microsoft Office Graphics Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-33154 Windows Partition Management Driver Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-33155 Windows Cloud Files Mini Filter Driver Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-33158 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-33161 Microsoft Excel Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35299 Windows Common Log File System Driver Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35304 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35305 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35312 Microsoft VOLSNAP.SYS Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain administrator privileges. Elevation of Privilege Exploitation More Likely
CVE-2023-35317 Windows Server Update Service (WSUS) Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain administrator privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35320 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35323 Windows OLE Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35328 Windows Transaction Manager Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35337 Win32k Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35340 Windows CNG Key Isolation Service Elevation of Privilege Vulnerability Important 7.8 No No

Scope = Changed, Jump Point = True

In this case, a successful attack could be performed from a low privilege AppContainer. The attacker could elevate their privileges and execute code or access resources at a higher integrity level than that of the AppContainer execution environment.

 Elevation of Privilege Exploitation Less Likely
CVE-2023-35342 Windows Image Acquisition Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35343 Windows Geolocation Service Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35353 Connected User Experiences and Telemetry Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35356 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35357 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35358 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35362 Windows Clip Service Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35363 Windows Kernel Elevation of Privilege Vulnerability Important 7.8 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35374 Paint 3D Remote Code Execution Vulnerability Important 7.8 No No

You can check the package version in PowerShell:

Get-AppxPackage -Name Microsoft.MSPaint

 Remote Code Execution Exploitation Less Likely
CVE-2023-36867 Visual Studio Code GitHub Pull Requests and Issues Extension Remote Code Execution Vulnerability Important 7.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-32044 Microsoft Message Queuing Denial of Service Vulnerability Important 7.5 No No Denial of Service Exploitation Less Likely
CVE-2023-32045 Microsoft Message Queuing Denial of Service Vulnerability Important 7.5 No No Denial of Service Exploitation Less Likely
CVE-2023-32084 HTTP.sys Denial of Service Vulnerability Important 7.5 No No Denial of Service Exploitation Less Likely
CVE-2023-33163 Windows Network Load Balancing Remote Code Execution Vulnerability Important 7.5 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35298 HTTP.sys Denial of Service Vulnerability Important 7.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35309 Microsoft Message Queuing Remote Code Execution Vulnerability Important 7.5 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35325 Windows Print Spooler Information Disclosure Vulnerability Important 7.5 No No Information Disclosure Exploitation Less Likely
CVE-2023-35330 Windows Extended Negotiation Denial of Service Vulnerability Important 7.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35338 Windows Peer Name Resolution Protocol Denial of Service Vulnerability Important 7.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35339 Windows CryptoAPI  Denial of Service Vulnerability Important 7.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35348 Active Directory Federation Service Security Feature Bypass Vulnerability Important 7.5 No No Scope = Changed, Jump Point = True Security Feature Bypass Exploitation Less Likely
CVE-2023-21526 Windows Netlogon Information Disclosure Vulnerability Important 7.4 No No An attacker who successfully exploited this vulnerability could intercept and potentially modify traffic between client and server systems. Information Disclosure Exploitation More Likely
CVE-2023-32054 Volume Shadow Copy Elevation of Privilege Vulnerability Important 7.3 No No Elevation of Privilege Exploitation Less Likely
CVE-2023-35350 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability Important 7.2 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35347 Microsoft Store Install Service Elevation of Privilege Vulnerability Important 7.1 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-32050 Windows Installer Elevation of Privilege Vulnerability Important 7.0 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-33152 Microsoft ActiveX Remote Code Execution Vulnerability Important 7.0 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35360 Windows Kernel Elevation of Privilege Vulnerability Important 7.0 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35361 Windows Kernel Elevation of Privilege Vulnerability Important 7.0 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-32043 Windows Remote Desktop Security Feature Bypass Vulnerability Important 6.8 No No Security Feature Bypass Exploitation Less Likely
CVE-2023-33153 Microsoft Outlook Remote Code Execution Vulnerability Important 6.8 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35332 Windows Remote Desktop Protocol Security Feature Bypass Important 6.8 No No Security Feature Bypass Exploitation Less Likely
CVE-2023-32055 Active Template Library Elevation of Privilege Vulnerability Important 6.7 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35313 Windows Online Certificate Status Protocol (OCSP) SnapIn Remote Code Execution Vulnerability Important 6.7 No No Remote Code Execution Exploitation Less Likely
CVE-2023-32033 Microsoft Failover Cluster Remote Code Execution Vulnerability Important 6.6 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35310 Windows DNS Server Remote Code Execution Vulnerability Important 6.6 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35344 Windows DNS Server Remote Code Execution Vulnerability Important 6.6 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35345 Windows DNS Server Remote Code Execution Vulnerability Important 6.6 No No Remote Code Execution Exploitation Less Likely
CVE-2023-35346 Windows DNS Server Remote Code Execution Vulnerability Important 6.6 No No Remote Code Execution Exploitation Less Likely
CVE-2023-32034 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-32035 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-32037 Windows Layer-2 Bridge Network Driver Information Disclosure Vulnerability Important 6.5 No No Information Disclosure Exploitation Less Likely
CVE-2023-32042 OLE Automation Information Disclosure Vulnerability Important 6.5 No No Information Disclosure Exploitation Less Likely
CVE-2023-32083 Microsoft Failover Cluster Information Disclosure Vulnerability Important 6.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Information Disclosure Exploitation Less Likely
CVE-2023-33151 Microsoft Outlook Spoofing Vulnerability Important 6.5 No No Spoofing Exploitation Less Likely
CVE-2023-33164 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-33166 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-33167 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-33168 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-33169 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-33172 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-33173 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35296 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability Important 6.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Information Disclosure Exploitation Less Likely
CVE-2023-35308 Windows MSHTML Platform Security Feature Bypass Vulnerability Important 6.5 No No Security Feature Bypass Exploitation Less Likely
CVE-2023-35316 Remote Procedure Call Runtime Information Disclosure Vulnerability Important 6.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Information Disclosure Exploitation Less Likely
CVE-2023-35318 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35319 Remote Procedure Call Runtime Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35321 Windows Deployment Services Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35329 Windows Authentication Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35331 Windows Local Security Authority (LSA) Denial of Service Vulnerability Important 6.5 No No Denial of Service Exploitation Less Likely
CVE-2023-35336 Windows MSHTML Platform Security Feature Bypass Vulnerability Important 6.5 No No Security Feature Bypass Exploitation Less Likely
CVE-2023-35351 Windows Active Directory Certificate Services (AD CS) Remote Code Execution Vulnerability Important 6.5 No No Remote Code Execution Exploitation Less Likely
CVE-2023-36868 Azure Service Fabric on Windows Information Disclosure Vulnerability Important 6.5 No No Information Disclosure Exploitation Less Likely
CVE-2023-36871 Azure Active Directory Security Feature Bypass Vulnerability Important 6.5 No No Security Feature Bypass N/A
CVE-2023-33156 Microsoft Defender Elevation of Privilege Vulnerability Important 6.3 No No An attacker who successfully exploited this vulnerability could gain SYSTEM privileges. Elevation of Privilege Exploitation Less Likely
CVE-2023-35341 Microsoft DirectMusic Information Disclosure Vulnerability Important 6.2 No No Information Disclosure Exploitation Less Likely
CVE-2023-32039 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server. Information Disclosure Exploitation Less Likely
CVE-2023-32040 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server. Information Disclosure Exploitation Less Likely
CVE-2023-32041 Windows Update Orchestrator Service Information Disclosure Vulnerability Important 5.5 No No Information Disclosure Exploitation Less Likely
CVE-2023-32085 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Information Disclosure Exploitation Less Likely
CVE-2023-33162 Microsoft Excel Information Disclosure Vulnerability Important 5.5 No No Information Disclosure Exploitation Less Likely
CVE-2023-33174 Windows Cryptographic Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Information Disclosure Exploitation Less Likely
CVE-2023-35306 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could view heap memory from a privileged process running on the server. Information Disclosure Exploitation Less Likely
CVE-2023-35324 Microsoft PostScript and PCL6 Class Printer Driver Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Information Disclosure Exploitation Less Likely
CVE-2023-35326 Windows CDP User Components Information Disclosure Vulnerability Important 5.5 No No Information Disclosure Exploitation Less Likely
CVE-2023-36872 VP9 Video Extensions Information Disclosure Vulnerability Important 5.5 No No An attacker who successfully exploited this vulnerability could potentially read small portions of heap memory. Information Disclosure Exploitation Less Likely
CVE-2023-32052 Microsoft Power Apps Spoofing Vulnerability Important 5.4 No No Spoofing Exploitation Less Likely
CVE-2023-35314 Remote Procedure Call Runtime Denial of Service Vulnerability Important 5.3 No No Denial of Service Exploitation Less Likely
CVE-2023-35373 Mono Authenticode Validation Spoofing Vulnerability Important 5.3 No No Spoofing Exploitation Less Likely
CVE-2023-33165 Microsoft SharePoint Server Security Feature Bypass Vulnerability Important 4.3 No No Security Feature Bypass Exploitation Less Likely
Syxsense demo

Schedule Your Syxsense Demo

Syxsense combines IT management, patch management, and security vulnerability scanning in one powerful solution. Get started today.

Schedule My Demo
July 11, 2023
Love0
Third Party Update from Syxsense

June 2023 3rd Party Roundup Webinar

By Patch Management, Patch Tuesday, Video, Webinars

Don’t miss out on June’s powerful Patch Management Update.

Fill out the form to the right to watch as we dive into June’s bulletins and show you strategies for tackling the latest and most important Patch updates. Our IT industry expert, Jon Cassell, Syxsense’s Senior Solutions Architect, covers all of the latest updates.

Syxsense spots critical threats early and deploys instantly, with curated patch content that includes risk assessment, patch prioritization, and dedicated Patch scheduling for simple deployment every month.

Our experts have deployed over 100 million patches. Join us as we tackle this month’s updates and then get your own customized demo to see how Syxsense can help you manage Patch vulnerabilities and more.

Watch the Webinar

Jon_Cassell

Hosted By: Jon Cassell, Syxsense Senior Solutions Architect

Jon is currently a Senior Solutions Architect at Syxsense and has been working in the IT and Infrastructure industries for the last 15 years. Before working at Syxsense, he was an IT Manager for a large financial services firm and has a background in Accounting and Tax consultation. He currently holds an MCSA in Server Infrastructure, A+, Network+, Security+, and Server+ certifications.

June 27, 2023
Love0