CVE-2023-21715
Microsoft Office Publisher Security Feature Bypass Vulnerability
Description
CVE-2023-21715 is a security feature bypass vulnerability in Microsoft Publisher, a component of Microsoft 365 Apps. The flaw, classified as an incorrect authorization weakness, allows a locally authenticated attacker to bypass Office macro security policies that would normally block untrusted or malicious files. Successful exploitation requires user interaction — the victim must open a specially crafted Publisher document — but once triggered, the attacker can execute code with the privileges of the current user, achieving high impact on confidentiality, integrity, and availability. With a CVSS score of 7.3 (High) and confirmed active exploitation in CISA's Known Exploited Vulnerabilities catalog, CVE-2023-21715 poses a significant threat to organizations relying on Microsoft 365 Apps.
KEV Information
CVSS Score
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:HOpen in CalculatorAffected Products
| Vendor | Product | Version |
|---|---|---|
| microsoft | 365 apps | - |
Multiple CVSS Assessments
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
CVSS:3.1/AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-21715(Patch, Vendor Advisory)
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2023-21715(US Government Resource)
Weakness Type
CWE-863: Incorrect Authorization
In the context of Microsoft Publisher, CWE-863 manifests as a failure to properly enforce macro security policies. The application does not correctly verify whether a document's macros should be blocked based on the configured trust settings, allowing an attacker to craft a Publisher document that bypasses these security controls. This incorrect authorization enables the execution of macros that should have been prevented by the security policy, effectively undermining a key defense against document-based malware.
Learn more: CWE-863 — Incorrect Authorization
Impact Analysis
CVE-2023-21715 has a CVSS score of 7.3 (High), reflecting a locally exploitable vulnerability with significant impact potential. The vulnerability requires local access (Attack Vector: Local), meaning the attacker must deliver a malicious Publisher document to the victim through phishing, file sharing, or other delivery mechanisms. Attack complexity is low, requiring no special conditions beyond delivering the crafted document. Low privileges are required — the attacker needs only basic user-level access, not administrative rights. User interaction is required, as the victim must open the malicious Publisher file for exploitation to occur. Confidentiality, integrity, and availability are all rated as High impact, because bypassing macro security policies can lead to arbitrary code execution under the user's context, enabling data theft, system modification, and disruption of services. While the EPSS score of 0.7% (70th percentile) suggests moderate exploitation probability, the CISA KEV listing confirms that this vulnerability is being actively leveraged in real-world attacks, often as an initial access vector in targeted campaigns.
Exploit Maturity
CISA has confirmed active exploitation of CVE-2023-21715 in the wild by adding it to the Known Exploited Vulnerabilities catalog with a mandatory remediation deadline of March 7, 2023. The vulnerability serves as a security feature bypass that enables attackers to circumvent Office macro policies — a critical defense mechanism against document-based attacks — making it a valuable tool in phishing and social engineering campaigns. No public proof-of-concept exploit code was identified in the available references, but the confirmed KEV status indicates that threat actors have developed working exploits used in targeted operations. The EPSS score of 0.7% (70th percentile) suggests that while exploitation is not yet widespread, it is actively occurring in targeted scenarios where attackers seek to bypass macro security controls in Microsoft Publisher.
Remediation
- Apply the Microsoft security update immediately. Install the patch provided by Microsoft through the Security Update Guide for CVE-2023-21715. This update corrects the authorization logic in Microsoft Publisher to properly enforce macro security policies. CISA requires remediation by 2023-03-07.
- Update Microsoft 365 Apps to the latest version. Ensure that all Microsoft 365 Apps installations across the organization are current with the latest security updates. Enable automatic updates where possible to prevent regression.
- Enforce strict macro security policies via Group Policy. Configure Group Policy settings to block macros in Office documents from the internet ("Block macros from running in Office files from the Internet") and ensure that Trust Center settings prevent execution of unsigned macros in Publisher documents.
- Implement email and file filtering controls. Configure email security gateways and endpoint protection to detect and quarantine Publisher files (.pub) containing macros, particularly those received from external sources. Consider blocking .pub file attachments entirely if Publisher is not widely used in your organization.
- Educate users on document-based threats. Since exploitation requires user interaction (opening a malicious Publisher document), reinforce security awareness training about the risks of opening unexpected or untrusted Office documents, especially Publisher files received via email or downloaded from the internet.
Technical Details
CVE-2023-21715 is classified under CWE-863 (Incorrect Authorization) and affects Microsoft Publisher as part of Microsoft 365 Apps. The vulnerability resides in the authorization logic that enforces macro security policies within Publisher, where the application fails to correctly evaluate whether macros in a document should be blocked based on the configured trust and security settings. An attacker can craft a Publisher document that exploits this authorization flaw to bypass macro blocking policies, causing the application to allow execution of macros that should have been prevented. The CVSS vector (AV:L/AC:L/PR:L/UI:R/S:U/C:H/I:H/A:H) indicates that exploitation occurs locally through a malicious document, requires low privileges and user interaction (opening the file), and achieves high impact across all three CIA triad dimensions within the scope of the user's session. The security feature bypass is particularly dangerous because macro security policies are a primary defense against document-based malware delivery, and circumventing these controls removes a key barrier in the attack chain.
Frequently Asked Questions
Is CVE-2023-21715 being actively exploited?
Yes, CISA has confirmed active exploitation of CVE-2023-21715 in the wild and added it to the Known Exploited Vulnerabilities catalog with a remediation deadline of March 7, 2023. The vulnerability is used to bypass Office macro security policies in Microsoft Publisher, enabling attackers to deliver malicious macros through crafted documents. The ransomware association is currently unknown.
What products are affected by CVE-2023-21715?
CVE-2023-21715 affects Microsoft 365 Apps, specifically the Microsoft Publisher component. All versions of Microsoft 365 Apps prior to the security update that addresses this vulnerability are affected. Organizations using Publisher as part of their Microsoft 365 suite should apply the patch immediately.
How do I fix CVE-2023-21715?
Install the Microsoft security update for CVE-2023-21715 available through the Microsoft Security Update Guide. Ensure all Microsoft 365 Apps installations are updated to the latest patched version. As additional protection, enforce Group Policy settings to block macros in Office documents from the internet and consider filtering Publisher file attachments in email. See the Remediation section for detailed steps.
How severe is CVE-2023-21715?
CVE-2023-21715 is rated High with a CVSS score of 7.3 out of 10.0. While it requires local access and user interaction (opening a malicious document), the impact is high across confidentiality, integrity, and availability. The vulnerability bypasses a critical security control (macro policies), making it particularly dangerous as an initial access vector in targeted phishing campaigns. The EPSS score of 0.7% (70th percentile) reflects targeted rather than widespread exploitation.
Need Help With Vulnerability Management?
Our security experts can help you prioritize and remediate vulnerabilities effectively.