CVE-2023-23391
Published: 14 March 2023
Summary
CVE-2023-23391 is a medium-severity Relative Path Traversal (CWE-23) vulnerability in Microsoft 365 Copilot. Its CVSS base score is 5.5 (Medium).
Operationally, ranked in the top 20.9% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
CVE-2023-23391 is a spoofing vulnerability affecting Microsoft Office for Android. It carries a CVSS 3.1 score of 5.5 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N and is associated with CWE-23.
An attacker with local access and no privileges can exploit the flaw when a user performs a specific action, resulting in high impact to integrity while leaving confidentiality and availability unaffected.
Microsoft security advisories linked in the references describe available updates and mitigation steps. The EPSS score started low after disclosure, rose materially to a peak of 0.0762 on 2025-01-22, and has since receded to 0.0117, indicating a period of increased exploitation interest well after the original publication date.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-27491
Vulnerability details
Office for Android Spoofing Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.