Patch Tuesday, February 2023
Microsoft's monthly security release, Tuesday, February 14, 2023. Includes CVEs published within two days either side; Adobe and SAP ride the same day.
3 CVEs · 0 critical · 3 exploited · 1 with public exploit code
Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.
Microsoft
3 CVEs · 0 critical · 3 exploited · 1 with public exploit code
- 7.8HighFeb 14, 2023Microsoft Windows Memory corruptionCVE-2023-21823Microsoft Windows Graphic Component contains an unspecified vulnerability that allows for privilege escalation.Exploited5.6% likelyExploit code
- 7.8HighFeb 14, 2023Microsoft Windows Memory corruptionCVE-2023-23376Microsoft Windows Common Log File System (CLFS) driver contains an unspecified vulnerability that allows for privilege escalation.Exploited11% likely
- 7.3HighFeb 14, 2023Microsoft Office Auth bypass / access controlCVE-2023-21715Microsoft Office Publisher contains a security feature bypass vulnerability that allows for a local, authenticated attack on a targeted system.Exploited12% likely
Adobe
No tracked Adobe CVEs in this window.
SAP
2 CVEs · 0 critical · 0 exploited · 0 with public exploit code
- 6.5MediumFeb 14, 2023Sap solution manager XSSCVE-2023-0025SAP Solution Manager (BSP Application) - version 720, allows an authenticated attacker to craft a malicious link, which when clicked by an unsuspecting user, can be used to read or modify some sensitive information or craft a payload which may restrict access to the desired resources.
- 6.1MediumFeb 14, 2023Sap netweaver as abap business server pages XSSCVE-2023-24521Due to insufficient input sanitization, SAP NetWeaver AS ABAP (BSP Framework) - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, allows an unauthenticated user to alter the current session of the user by injecting the malicious code over the network and gain access to the unintended data. This may lead to a limited impact on the confidentiality and the integrity of the application.
The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.