CVE-2015-2423 Privilege escalation in n/a
Attackers can escalate privileges and read sensitive data by tricking users into opening crafted files in Office or Notepad.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2015-2423?
CVE-2015-2423 is a medium-severity vulnerability in Microsoft Excel, published on 15 Aug 2015. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Microsoft Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT Gold and 8.1, Windows 10, Excel 2007 SP3, PowerPoint 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2010 SP2, Excel 2010 SP2, PowerPoint 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Excel 2013 SP1, PowerPoint 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, PowerPoint 2013 RT SP1, Visio 2013 RT SP1, Word 2013 RT SP1, and Internet Explorer 7 through 11 allow remote attackers to gain privileges and obtain sensitive information via a crafted command-line parameter to an Office application or Notepad, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Unsafe Command Line Parameter Passing Vulnerability."
Weakness: CWE-200
Which versions are affected by CVE-2015-2423?
It affects 15 products.
Products include Microsoft Excel, Microsoft Internet Explorer, Microsoft Office, Microsoft Powerpoint, Microsoft Visio, Microsoft Windows 10 and 9 more.
How do I fix CVE-2015-2423?
No fix has been published for CVE-2015-2423 yet. Limit exposure of the affected software until one is available.
Is CVE-2015-2423 being exploited?
There is no known exploitation of CVE-2015-2423 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Excel
Sources
Also known as GHSA-w76h-498m-3wj9.