- Vulnerability
- March 2023
CVE-2023-23397: Outlook credential theft with no click required
An Outlook elevation-of-privilege flaw that leaks NTLM credentials to an attacker-controlled host with no user interaction.
Attribution
Published by the Logpoint security research team, which I led.
I led the research function that produced this work. The byline is the team’s, not mine.
Coverage of CVE-2023-23397, an Outlook vulnerability that triggers on message delivery rather than on a click, causing the client to authenticate to a host the attacker controls and leaking the NTLM hash.
The original post has not been recovered since the Guardsix rebrand. Until it is, this entry stands on the record of it being shared rather than on a link.
Identifier
The machine-readable references this entry covers.
- CVE-2023-23397CVE
Original link not recovered
The URL did not survive the move from Logpoint to Guardsix and has not been recovered since. Nothing has been substituted for it, so this entry stands on the record of the work rather than on a link to it.