CVE Vulnerability Advisory Database
Filter vulnerabilities by CVSS severity, active CISA KEV exploitation, and technology stack.
Showing 1โ1 of 1 advisories (Page 1/1)
2023-09-12
Microsoft Word Information Disclosure and NTLM Hash Leakage Vulnerability (CVE-2023-36761) Technical Analysis & Mitigation Guide
[Affected Scope] Broad range of Microsoft Office products including Microsoft Word 2013, 2016, 2019, 2021, and Microsoft 365 Apps
[Impact] Attackers can force the victim's system to leak NTLM credentials (hashes) to an external malicious server simply by having the victim select or preview a crafted document in the Preview Pane
[Mitigation] Apply the official Microsoft security updates immediately, block outbound SMB (TCP 445) traffic at the perimeter, and restrict outbound NTLM authentication via Group Policy