CVE-2023-32046
Published: 11 July 2023
Summary
CVE-2023-32046 is a high-severity an unspecified weakness vulnerability in Microsoft Windows Server 2008. Its CVSS base score is 7.8 (High).
Operationally, ranked in the top 2.4% of CVEs by exploit likelihood; CISA has added it to the Known Exploited Vulnerabilities catalog.
The strongest mitigations our analysis identified are NIST 800-53 SI-2 (Flaw Remediation) and AC-6 (Least Privilege).
Deeper analysis
CVE-2023-32046 is an elevation of privilege vulnerability in the Windows MSHTML Platform. It carries a CVSS 3.1 base score of 7.8 with the vector AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H and was published on 11 July 2023.
An attacker with the ability to run code on a local system can exploit the flaw by convincing a user to interact with specially crafted content, resulting in the attacker gaining elevated privileges equivalent to those of the targeted user account.
Microsoft has published remediation guidance through its Security Response Center update guide, and the vulnerability appears in the CISA Known Exploited Vulnerabilities catalog.
The associated EPSS score has remained steady at a peak of 0.4266 since disclosure, indicating sustained but not sharply increasing exploitation interest.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-36333
Vulnerability details
Windows MSHTML Platform Elevation of Privilege Vulnerability
- CWE(s)
- KEV Date Added
- 11 July 2023
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
Mitigating Controls (NIST 800-53 r5) AI
Directly requires timely application of Microsoft security updates that remediate the MSHTML EoP flaw.
Malicious-code protections can block or sandbox crafted files or web content used to trigger the vulnerability.
Least-privilege execution limits the impact of successful local privilege escalation from the MSHTML flaw.