CVE-2023-36563

Vulnerability updated 7 days ago (2024-11-29T14:01:13.604Z)
Download STIX
Preview STIX
CVE-2023-36563 is a critical information disclosure vulnerability discovered in Microsoft WordPad. The flaw, categorized as a zero-day bug, was one of the twelve vulnerabilities rated as 'Critical' among 104 issues addressed by Microsoft. The vulnerability was exploited actively in the wild, affecting not only Microsoft Windows and Server but also software such as Microsoft Visual Studio, .NET, and ASP.NET Core. Technical details of this vulnerability were publicly disclosed, raising its risk profile. Microsoft responded swiftly to the threat by releasing patches for CVE-2023-36563 along with two other zero-day vulnerabilities: an elevation-of-privilege flaw in Skype for Business (CVE-2023-41763) and a novel DDoS attack technique named “HTTP/2 Rapid Reset” (CVE-2023-44487). These patches were released on the same day that the vulnerabilities were identified, demonstrating a proactive stance in maintaining the security of their software products. In addition to Microsoft's actions, the Cybersecurity & Infrastructure Security Agency (CISA) added both the WordPad and Skype for Business flaws to the Known Exploited Vulnerabilities (KEV) list. This move further highlighted the severity of these exploits and underscored the need for immediate action from all affected parties. Users of the impacted software are strongly advised to apply the provided patches promptly to mitigate potential risks associated with these vulnerabilities.
Description last updated: 2024-05-04T16:49:52.539Z
What's your take? (Question 1 of 5)
Help tune the shared Cybergeist dataset, assist your peers, and earn karma. Expand the panel to get started.
Possible Aliases / Cluster overlaps
It's hard to track cluster overlaps and naming conventions between vendors, so here are some possible overlapping names / profiles you also may want to look at. Create a free account to see the source evidence for each alias, and help fix any errors.
Alias DescriptionVotes
CVE-2023-41763 is a possible alias for CVE-2023-36563. CVE-2023-41763 is a significant software vulnerability, identified as an elevation of privilege flaw, found within Microsoft's Skype for Business. This zero-day vulnerability allows malicious actors to gain unauthorized access and control over affected systems, posing a severe risk to the integrity,
3
Miscellaneous Associations
Other elements of context that could aid in the identification of relevance
Vulnerability
Microsoft
Skype
Zero Day
Analyst Notes & Discussion
Be the first to leave your mark here! Log in to share your views and vote.
Associated Vulnerabilities
To see the evidence that has resulted in these vulnerability associations, create a free account
Alias DescriptionAssociation TypeVotes
The CVE-2023-44487 Vulnerability is associated with CVE-2023-36563. CVE-2023-44487 is a high-severity vulnerability discovered in web servers supporting HTTP/2, which allows threat actors to exploit the 'stream multiplexing' feature. This flaw enables attackers to send repeated requests and cancel them immediately, leading to a 'Rapid Reset' attack causing Denial ofUnspecified
3
The Http/2 Rapid Reset Vulnerability is associated with CVE-2023-36563. The HTTP/2 Rapid Reset is a software vulnerability (CVE-2023-44487) that was discovered during testing and later disclosed by Cloudflare. This flaw in the design or implementation of HTTP/2 protocol allows for a type of Distributed Denial-of-Service (DDoS) attack, specifically at layer 7. The vulnerUnspecified
3
Source Document References
Information about the CVE-2023-36563 Vulnerability was read from the documents corpus below. This display is limited to 20 results, create a free account to see more
PreviewSource LinkCreatedAtTitle
CERT-EU
9 months ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
Krebs on Security
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CrowdStrike
a year ago
Checkpoint
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
BankInfoSecurity
a year ago
Securityaffairs
a year ago
CERT-EU
a year ago
CERT-EU
a year ago
CERT-EU
a year ago