Microsoft has addressed 94 vulnerabilities in this month’s Patch Tuesday, but just four rate greater than nine (9) on the Common Vulnerability Scoring System and none are flagged as under exploitation.
Windows Pragmatic General Multicast (PGM) is subject to three critical vulnerabilities: CVE-2023-32015, CVE-2023-32014, and CVE-2023-29363.
All three offer remote code execution, Microsoft’s advisories explain; all have a vulnerability score of 9.8.
“When Windows message queuing service is running in a PGM Server environment, an attacker could send a specially crafted file over the network to achieve remote code execution and attempt to trigger malicious code," it wrote.
The other top-rated bug is CVE-2023-29357, a SharePoint vulnerability that gives a successful attacker administrator privileges.
“An attacker who has gained access to spoofed JWT authentication tokens can use them to execute a network attack which bypasses authentication and allows them to gain access to the privileges of an authenticated user,” Microsoft wrote.
“The attacker needs no privileges, nor does the user need to perform any action.”
According to the SANS Institute, there are two Microsoft Exchange patches that warrant attention, even though they rate lower than critical.
“Exploitation requires authentication, so these remote code execution vulnerabilities are only regarded as important. But based on history with similar flaws, this issue is worth watching,” the institute’s Johannes Ullrich said.
CVE-2023-28310 allows an “authenticated attacker who is on the same intranet as the Exchange server can achieve remote code execution via a PowerShell remoting session”, while CVE-2023-32031 would let an authenticated user “attempt to trigger malicious code in the context of the server's account through a network call.”
