vulnwire
7.8high

CVE-2023-23402

Windows Media Remote Code Execution Vulnerability

Published 3 y ago · modified 4 mo ago · JSON

CVSS
7.8
v3.1 · CNA
CISA KEV
No
not known exploited
EPSS
0.6%
percentile 49%
Public exploits
0
none known

Windows Media Remote Code Execution Vulnerability

CISA SSVC assessment

Exploitation
none
Automatable
no
Technical impact
total
Assessed
2 y ago

Exploit prediction (EPSS)

0.60% probability of exploitation in the next 30 days, higher than 49% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C
CNA3.17.8CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products

  • Microsoft Windows 10 Version 1809
  • Microsoft Windows Server 2019
  • Microsoft Windows Server 2019 (Server Core installation)
  • Microsoft Windows Server 2022
  • Microsoft Windows 10 Version 20H2
  • Microsoft Windows 11 version 21H2
  • Microsoft Windows 10 Version 21H2
  • Microsoft Windows 11 version 22H2
  • Microsoft Windows 10 Version 22H2
  • Microsoft Windows 10 Version 1507
  • Microsoft Windows 10 Version 1607
  • Microsoft Windows Server 2016
  • Microsoft Windows Server 2016 (Server Core installation)
  • Microsoft Windows Server 2008 R2 Service Pack 1
  • Microsoft Windows Server 2008 R2 Service Pack 1 (Server Core installation)
  • Microsoft Windows Server 2012
  • Microsoft Windows Server 2012 (Server Core installation)
  • Microsoft Windows Server 2012 R2
  • Microsoft Windows Server 2012 R2 (Server Core installation)

Classification

Weakness

References

  • msrc.microsoft.com /update-guide/vulnerability/CVE-2023-23402 · vendor-advisory, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.