In the latest Patch Tuesday, Microsoft has addressed a total of 94 vulnerabilities. Among them, only four vulnerabilities scored higher than nine on the Common Vulnerability Scoring System, and none of them are currently being exploited.
Three critical vulnerabilities affecting Windows Pragmatic General Multicast (PGM) have been identified: CVE-2023-32015, CVE-2023-32014, and CVE-2023-29363. All three vulnerabilities enable remote code execution and have a vulnerability score of 9.8. Attackers could potentially exploit these vulnerabilities by sending specially crafted files over the network to trigger malicious code execution in a PGM Server environment.
Another high-rated vulnerability is CVE-2023-29357, which affects SharePoint. This vulnerability allows an attacker to gain administrator privileges. By utilizing spoofed JWT authentication tokens, an attacker can execute a network attack that bypasses authentication and grants access to the privileges of an authenticated user. No user action or additional privileges are required for the attacker.
While not classified as critical, two Microsoft Exchange vulnerabilities still deserve attention, according to the SANS Institute. Although authentication is necessary for exploitation, these remote code execution vulnerabilities are considered important. CVE-2023-28310 enables an authenticated attacker on the same intranet as the Exchange server to achieve remote code execution through a PowerShell remoting session. CVE-2023-32031 allows an authenticated user to attempt triggering malicious code in the server’s account context via a network call.
It is worth monitoring these Exchange vulnerabilities due to past experiences with similar flaws, as mentioned by Johannes Ullrich from the SANS Institute.
