CVE-2023-36897

Summary

Visual Studio Tools for Office Runtime Spoofing Vulnerability

Affected Software

VendorProductVersion RangeStatus
MicrosoftMicrosoft Office 201919.0.0 < https://aka.ms/OfficeSecurityReleasesaffected
MicrosoftMicrosoft 365 Apps for Enterprise16.0.1 < https://aka.ms/OfficeSecurityReleasesaffected
MicrosoftMicrosoft Office LTSC 202116.0.1 < https://aka.ms/OfficeSecurityReleasesaffected
MicrosoftMicrosoft Visual Studio 2017 version 15.9 (includes 15.0 - 15.8)15.9.0 < 15.9.56affected
MicrosoftMicrosoft Visual Studio 2022 version 17.217.2.0 < 17.2.18affected
MicrosoftMicrosoft Visual Studio 2019 version 16.11 (includes 16.0 - 16.10)16.11.0 < 16.11.29affected
MicrosoftMicrosoft Visual Studio 2022 version 17.417.4.0 < 17.4.10affected
MicrosoftMicrosoft Visual Studio 2022 version 17.617.6.0 < 17.6.6affected
MicrosoftVisual Studio 2010 Tools for Office Runtime10.0.0 < 10.0.60910affected

Weaknesses

  • CWE-20: CWE-20: Improper Input Validation

ADP Enrichment

CVE Program Container

Additional References

CISA ADP Vulnrichment

  • SSVC:
  • Exploitation: none
    • Automatable: no
    • Technical Impact: total

References