https://pwn.watch/t/ntlm Live security incidents worldwide: CVEs, patch status, fixed versions, advisories and the posts that broke them. en Fri, 24 Mar 2023 00:00:00 GMT https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397 https://pwn.watch/i/microsoft-outlook-ntlm-leak-cve-2023-23397 Fri, 24 Mar 2023 00:00:00 GMT critical <p>A crafted Outlook reminder with a UNC path made Outlook for Windows send the user's NTLM hash to an attacker's server without any click. Microsoft said a Russia-based actor (APT28) used it against European government, transport, energy and military targets.</p> <p><strong>Status:</strong> closed · <strong>Patch:</strong> patched · <strong>Fixed in:</strong> See vendor advisory (March 2023 security updates)</p> <p><strong>Latest updates:</strong></p><ul><li>2023-03-24: Microsoft publishes investigation guidance for CVE-2023-23397 (<a href="https://www.microsoft.com/en-us/security/blog/2023/03/24/guidance-for-investigating-attacks-using-cve-2023-23397/">source</a>)</li><li>2023-03-14: Patch Tuesday fix; CISA adds CVE-2023-23397 to KEV (<a href="https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23397">source</a>)</li></ul> <p><strong>CVEs:</strong> CVE-2023-23397</p>