Patch Tuesday, March 2023

Microsoft's monthly security release, Tuesday, March 14, 2023. Includes CVEs published within two days either side; Adobe and SAP ride the same day.

2 CVEs · 1 critical · 2 exploited · 1 with public exploit code

Microsoft only. Adobe and SAP are below. Exploited first, then public exploit code, then highest CVSS.

← February 2023 April 2023 →Open in the dashboard

Microsoft

2 CVEs · 1 critical · 2 exploited · 1 with public exploit code

9.8CriticalMar 14, 2023Microsoft Office Auth bypass / access controlCVE-2023-23397Microsoft Office Outlook contains a privilege escalation vulnerability that allows for a NTLM Relay attack against another service to authenticate as the user.Exploited97% likelyExploit codeDetection
4.4MediumMar 14, 2023Microsoft Windows Auth bypass / access controlCVE-2023-24880Microsoft Windows SmartScreen contains a security feature bypass vulnerability that could allow an attacker to evade Mark of the Web (MOTW) defenses via a specially crafted malicious file.Exploited78% likely

Adobe

No tracked Adobe CVEs in this window.

SAP

1 CVE · 0 critical · 0 exploited · 0 with public exploit code

6.5MediumMar 14, 2023Sap netweaver application server abap Denial of serviceCVE-2023-27270SAP NetWeaver Application Server for ABAP and ABAP Platform - versions 700, 701, 702, 731, 740, 750, 751, 752, 753, 754, 755, 756, 757, 791, has multiple vulnerabilities in a class for test purposes in which an attacker authenticated as a non-administrative user can craft a request with certain parameters, which will consume the server's resources sufficiently to make it unavailable. There is no ability to view or modify any information.

The release date follows Microsoft's usual schedule (second Tuesday). Chips show what Watch Floor knows: CISA KEV listing, public exploit code and published detection rules.