Microsoft's security release of 13 June 2023
Patch Tuesday, June 2023
As of , CISA lists two of the 58 CVEs Microsoft published on Patch Tuesday, , as exploited. Patch first: CVE-2023-29357, Microsoft SharePoint Server Elevation of Privilege.
On CISA's list of exploited vulnerabilities
- CVE-2023-29357Microsoft SharePoint Server Elevation of Privilege. Listed by CISA on 10 January 2024, 211 days after the release
- CVE-2023-29360Microsoft Streaming Service Elevation of Privilege. Listed by CISA on 29 February 2024, 261 days after the release
The release in numbers
| What | CVEs |
|---|---|
| CVE records Microsoft published | 58 CVEs |
| On CISA's list of exploited vulnerabilities | 2 CVEs |
| CISA's SSVC exploitation: active | 2 CVEs |
| CISA's SSVC exploitation: proof of concept | 2 CVEs |
| CISA's SSVC exploitation: none | 53 CVEs |
| Not assessed by CISA's SSVC | 1 CVE |
| Critical by CVSS (9.0 or more) | 4 CVEs |
| EPSS 0.10 or more | 4 CVEs |
Patch first: the release in our order
| # | Vulnerability | CISA's SSVC exploitation | CISA's list | CVSS | EPSS |
|---|---|---|---|---|---|
| 1 | CVE-2023-29357Microsoft SharePoint Server Elevation of Privilege | Active | Patch this weekListed | 9.8 Critical | 0.99 |
| 2 | CVE-2023-29360Microsoft Streaming Service Elevation of Privilege | Active | Patch soonListed | 8.4 High | 0.22 |
| 3 | CVE-2023-28303Windows Snipping Tool Information Disclosure | Proof of concept | Not on CISA's list | 3.3 Low | 0.02 |
| 4 | CVE-2023-32032.NET and Visual Studio Elevation of Privilege | Proof of concept | Not on CISA's list | 6.5 Medium | 0.01 |
| 5 | CVE-2023-32029Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.54 |
| 6 | CVE-2023-33133Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.44 |
| 7 | CVE-2023-33145Microsoft Edge (Chromium-based) Information Disclosure | Not assessed | Not on CISA's list | 6.5 Medium | 0.09 |
| 8 | CVE-2023-33131Microsoft Outlook Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.06 |
| 9 | CVE-2023-29358Windows GDI Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.05 |
| 10 | CVE-2023-29371Windows GDI Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.05 |
| 11 | CVE-2023-29361Windows Cloud Files Mini Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.04 |
| 12 | CVE-2023-33137Microsoft Excel Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.03 |
| 13 | CVE-2023-29363Windows Pragmatic General Multicast (PGM) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 14 | CVE-2023-32014Windows Pragmatic General Multicast (PGM) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 15 | CVE-2023-32015Windows Pragmatic General Multicast (PGM) Remote Code Execution | None | Not on CISA's list | 9.8 Critical | 0.02 |
| 16 | CVE-2023-29351Windows Group Policy Elevation of Privilege | None | Not on CISA's list | 8.1 High | 0.02 |
| 17 | CVE-2023-32011Windows iSCSI Discovery Service Denial of Service | None | Not on CISA's list | 7.5 High | 0.02 |
| 18 | CVE-2023-24938Windows CryptoAPI Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 19 | CVE-2023-29369Remote Procedure Call Runtime Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 20 | CVE-2023-33129Microsoft SharePoint Server Denial of Service | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 21 | CVE-2023-33140Microsoft OneNote Spoofing | None | Not on CISA's list | 6.5 Medium | 0.02 |
| 22 | CVE-2023-32013Windows Hyper-V Denial of Service | None | Not on CISA's list | 5.3 Medium | 0.02 |
| 23 | CVE-2023-29362Remote Desktop Client Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 24 | CVE-2023-29372Microsoft WDAC OLE DB provider for SQL Server Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 25 | CVE-2023-29373Microsoft ODBC Driver Remote Code Execution | None | Not on CISA's list | 8.8 High | 0.01 |
| 26 | CVE-2023-29359GDI Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 27 | CVE-2023-29365Windows Media Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 28 | CVE-2023-29366Windows Geolocation Service Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 29 | CVE-2023-29367iSCSI Target WMI Provider Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 30 | CVE-2023-29370Windows Media Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 31 | CVE-2023-32008Windows Resilient File System (ReFS) Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 32 | CVE-2023-32012Windows Container Manager Service Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.01 |
| 33 | CVE-2023-32018Windows Hello Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 34 | CVE-2023-33146Microsoft Office Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.01 |
| 35 | CVE-2023-32022Windows Server Service Security Feature Bypass | None | Not on CISA's list | 7.6 High | 0.01 |
| 36 | CVE-2023-33126.NET and Visual Studio Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 37 | CVE-2023-33128.NET and Visual Studio Remote Code Execution | None | Not on CISA's list | 7.3 High | 0.01 |
| 38 | CVE-2023-33130Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 7.3 High | 0.01 |
| 39 | CVE-2023-33135.NET and Visual Studio Elevation of Privilege | None | Not on CISA's list | 7.3 High | 0.01 |
| 40 | CVE-2023-21565Azure DevOps Server Spoofing | None | Not on CISA's list | 7.1 High | 0.01 |
| 41 | CVE-2023-32021Windows SMB Witness Service Security Feature Bypass | None | Not on CISA's list | 7.1 High | 0.01 |
| 42 | CVE-2023-33144Visual Studio Code Spoofing | None | Not on CISA's list | 6.6 Medium | 0.01 |
| 43 | CVE-2023-29352Windows Remote Desktop Security Feature Bypass | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 44 | CVE-2023-33142Microsoft SharePoint Server Elevation of Privilege | None | Not on CISA's list | 6.5 Medium | 0.01 |
| 45 | CVE-2023-33132Microsoft SharePoint Server Spoofing | None | Not on CISA's list | 6.3 Medium | 0.01 |
| 46 | CVE-2023-32020Windows DNS Spoofing | None | Not on CISA's list | 5.6 Medium | 0.01 |
| 47 | CVE-2023-21569Azure DevOps Server Spoofing | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 48 | CVE-2023-29353Sysinternals Process Monitor for Windows Denial of Service | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 49 | CVE-2023-32016Windows Installer Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 50 | CVE-2023-33139Visual Studio Information Disclosure | None | Not on CISA's list | 5.5 Medium | 0.01 |
| 51 | CVE-2023-29355DHCP Server Service Information Disclosure | None | Not on CISA's list | 5.3 Medium | 0.01 |
| 52 | CVE-2023-32019Windows Kernel Information Disclosure | None | Not on CISA's list | 4.7 Medium | 0.01 |
| 53 | CVE-2023-32009Windows Collaborative Translation Framework Elevation of Privilege | None | Not on CISA's list | 8.8 High | 0.00 |
| 54 | CVE-2023-29346NTFS Elevation of Privilege | None | Not on CISA's list | 7.8 High | 0.00 |
| 55 | CVE-2023-32017Microsoft PostScript Printer Driver Remote Code Execution | None | Not on CISA's list | 7.8 High | 0.00 |
| 56 | CVE-2023-29364Windows Authentication Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 57 | CVE-2023-29368Windows Filtering Platform Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
| 58 | CVE-2023-32010Windows Bus Filter Driver Elevation of Privilege | None | Not on CISA's list | 7.0 High | 0.00 |
By impact
What this page counts
The CVE records Microsoft published as a CVE Numbering Authority on 13 June 2023, the second Tuesday of the month. Microsoft's own release notes can also name CVEs other organisations assigned, such as Chromium's for Edge; those are not counted here.
Titles, CVSS scores and impact words are Microsoft's, from the CVE records. The list of exploited vulnerabilities and the SSVC values are CISA's. EPSS is FIRST's daily score. The order is ours: entries on CISA's list first, in our patch-first order, then CISA's SSVC exploitation value, then EPSS, then CVSS.