{
  "document": {
    "acknowledgments": [
      {
        "names": [
          "Lidor B. with Orca Security"
        ]
      }
    ],
    "aggregate_severity": {
      "namespace": "https://www.microsoft.com/en-us/msrc/security-update-severity-rating-system",
      "text": "Important"
    },
    "category": "csaf_security_advisory",
    "csaf_version": "2.0",
    "distribution": {
      "text": "Public",
      "tlp": {
        "label": "WHITE",
        "url": "https://www.first.org/tlp/"
      }
    },
    "lang": "en-US",
    "notes": [
      {
        "category": "general",
        "text": "To determine the support lifecycle for your software, see the Microsoft Support Lifecycle: https://support.microsoft.com/lifecycle",
        "title": "Additional Resources"
      },
      {
        "category": "legal_disclaimer",
        "text": "The information provided in the Microsoft Knowledge Base is provided \\\"as is\\\" without warranty of any kind. Microsoft disclaims all warranties, either express or implied, including the warranties of merchantability and fitness for a particular purpose. In no event shall Microsoft Corporation or its suppliers be liable for any damages whatsoever including direct, indirect, incidental, consequential, loss of business profits or special damages, even if Microsoft Corporation or its suppliers have been advised of the possibility of such damages. Some states do not allow the exclusion or limitation of liability for consequential or incidental damages so the foregoing limitation may not apply.",
        "title": "Disclaimer"
      },
      {
        "category": "general",
        "text": "Required. The vulnerability documented by this CVE requires customer action to resolve.",
        "title": "Customer Action"
      }
    ],
    "publisher": {
      "category": "vendor",
      "contact_details": "secure@microsoft.com",
      "name": "Microsoft Security Response Center",
      "namespace": "https://msrc.microsoft.com"
    },
    "references": [
      {
        "category": "self",
        "summary": "CVE-2023-23383 Service Fabric Explorer Spoofing Vulnerability - HTML",
        "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23383"
      },
      {
        "category": "self",
        "summary": "CVE-2023-23383 Service Fabric Explorer Spoofing Vulnerability - CSAF",
        "url": "https://msrc.microsoft.com/csaf/2023/msrc_cve-2023-23383.json"
      },
      {
        "category": "external",
        "summary": "Microsoft Exploitability Index",
        "url": "https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1"
      },
      {
        "category": "external",
        "summary": "Microsoft Support Lifecycle",
        "url": "https://support.microsoft.com/lifecycle"
      },
      {
        "category": "external",
        "summary": "Common Vulnerability Scoring System",
        "url": "https://www.first.org/cvss"
      }
    ],
    "title": "Service Fabric Explorer Spoofing Vulnerability",
    "tracking": {
      "current_release_date": "2023-06-29T07:00:00.000Z",
      "generator": {
        "date": "2025-01-01T00:47:47.522Z",
        "engine": {
          "name": "MSRC Generator",
          "version": "1.0"
        }
      },
      "id": "msrc_CVE-2023-23383",
      "initial_release_date": "2023-03-14T07:00:00.000Z",
      "revision_history": [
        {
          "date": "2023-03-14T07:00:00.000Z",
          "legacy_version": "1",
          "number": "1",
          "summary": "Information published."
        },
        {
          "date": "2023-05-09T07:00:00.000Z",
          "legacy_version": "1.1",
          "number": "2",
          "summary": "Added FAQ information. This is an informational change only."
        },
        {
          "date": "2023-06-13T07:00:00.000Z",
          "legacy_version": "1.2",
          "number": "3",
          "summary": "Added FAQ information. This is an informational change only."
        },
        {
          "date": "2023-06-29T07:00:00.000Z",
          "legacy_version": "2",
          "number": "4",
          "summary": "Corrected Download and Article links in the Security Updates table. This is an informational change only."
        }
      ],
      "status": "final",
      "version": "4"
    }
  },
  "product_tree": {
    "branches": [
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c9.0.1317.1",
            "product": {
              "name": "Azure Service Fabric 9.0 for Linux \u003c9.0.1317.1",
              "product_id": "4"
            }
          },
          {
            "category": "product_version",
            "name": "9.0.1317.1",
            "product": {
              "name": "Azure Service Fabric 9.0 for Linux 9.0.1317.1",
              "product_id": "12125"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Service Fabric 9.0 for Linux"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c9.1.1583.9590",
            "product": {
              "name": "Azure Service Fabric 9.1 for Windows \u003c9.1.1583.9590",
              "product_id": "3"
            }
          },
          {
            "category": "product_version",
            "name": "9.1.1583.9590",
            "product": {
              "name": "Azure Service Fabric 9.1 for Windows 9.1.1583.9590",
              "product_id": "12171"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Service Fabric 9.1 for Windows"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c9.1.1388.1",
            "product": {
              "name": "Azure Service Fabric 9.1 for Ubuntu \u003c9.1.1388.1",
              "product_id": "2"
            }
          },
          {
            "category": "product_version",
            "name": "9.1.1388.1",
            "product": {
              "name": "Azure Service Fabric 9.1 for Ubuntu 9.1.1388.1",
              "product_id": "12172"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Service Fabric 9.1 for Ubuntu"
      },
      {
        "branches": [
          {
            "category": "product_version_range",
            "name": "\u003c9.0.1380.9590",
            "product": {
              "name": "Azure Service Fabric 9.0 for Windows \u003c9.0.1380.9590",
              "product_id": "1"
            }
          },
          {
            "category": "product_version",
            "name": "9.0.1380.9590",
            "product": {
              "name": "Azure Service Fabric 9.0 for Windows 9.0.1380.9590",
              "product_id": "12208"
            }
          }
        ],
        "category": "product_name",
        "name": "Azure Service Fabric 9.0 for Windows"
      }
    ]
  },
  "vulnerabilities": [
    {
      "cve": "CVE-2023-23383",
      "cwe": {
        "id": "CWE-79",
        "name": "Improper Neutralization of Input During Web Page Generation (\u0027Cross-site Scripting\u0027)"
      },
      "notes": [
        {
          "category": "general",
          "text": "Microsoft",
          "title": "Assigning CNA"
        },
        {
          "category": "faq",
          "text": "A victim user would have to click the stored XSS payload injected by the attacker to be compromised.",
          "title": "According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?"
        },
        {
          "category": "faq",
          "text": "An attacker who successfully exploited this vulnerability could potentially view sensitive data and perform operations on the targeted Service Fabric cluster, which could impact data integrity or availability.",
          "title": "According to the CVSS metric, confidentiality impact is low (C:L) but Integrity and Availability are High (I:H, A:H). What does that mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "If you have automatic updates, no action is needed. However, for those who choose to manually update, please refer to Manage Service Fabric cluster upgrades for instructions on how to update your Service Fabric Cluster.",
          "title": "How can I update my Service Fabric Cluster to the latest version?"
        },
        {
          "category": "faq",
          "text": "The vulnerability is in the web client, but the malicious scripts executed in the victim\u2019s browser translate into actions executed in the (remote) cluster.",
          "title": "According to the CVSS metric, a successful exploitation could lead to a scope change (S:C). What does this mean for this vulnerability?"
        },
        {
          "category": "faq",
          "text": "For this vulnerability to be successfully exploited, an unauthenticated attacker would have convince or trick the victim to click through a sequence of multiple events.",
          "title": "According to the CVSS metric, the attack complexity is high (AC:H) and privileges required is none (PR:N). What does that mean for this vulnerability?"
        }
      ],
      "product_status": {
        "fixed": [
          "12125",
          "12171",
          "12172",
          "12208"
        ],
        "known_affected": [
          "1",
          "2",
          "3",
          "4"
        ]
      },
      "references": [
        {
          "category": "self",
          "summary": "CVE-2023-23383 Service Fabric Explorer Spoofing Vulnerability - HTML",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23383"
        },
        {
          "category": "self",
          "summary": "CVE-2023-23383 Service Fabric Explorer Spoofing Vulnerability - CSAF",
          "url": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23383"
        }
      ],
      "remediations": [
        {
          "category": "vendor_fix",
          "date": "2023-03-14T07:00:00.000Z",
          "details": "9.0.1317.1:Security Update:https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_90CU8.md",
          "product_ids": [
            "4"
          ],
          "url": "https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_90CU8.md"
        },
        {
          "category": "vendor_fix",
          "date": "2023-03-14T07:00:00.000Z",
          "details": "9.1.1583.9590:Security Update:https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_91CU2.md",
          "product_ids": [
            "3"
          ],
          "url": "https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_91CU2.md"
        },
        {
          "category": "vendor_fix",
          "date": "2023-03-14T07:00:00.000Z",
          "details": "9.1.1388.1:Security Update:https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_91CU2.md",
          "product_ids": [
            "2"
          ],
          "url": "https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_91CU2.md"
        },
        {
          "category": "vendor_fix",
          "date": "2023-03-14T07:00:00.000Z",
          "details": "9.0.1380.9590:Security Update:https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_90CU8.md",
          "product_ids": [
            "1"
          ],
          "url": "https://github.com/microsoft/service-fabric/blob/master/release_notes/Service_Fabric_ReleaseNotes_90CU8.md"
        }
      ],
      "scores": [
        {
          "cvss_v3": {
            "attackComplexity": "HIGH",
            "attackVector": "NETWORK",
            "availabilityImpact": "HIGH",
            "baseScore": 8.2,
            "baseSeverity": "HIGH",
            "confidentialityImpact": "LOW",
            "environmentalsScore": 0.0,
            "exploitCodeMaturity": "UNPROVEN",
            "integrityImpact": "HIGH",
            "privilegesRequired": "NONE",
            "remediationLevel": "OFFICIAL_FIX",
            "reportConfidence": "CONFIRMED",
            "scope": "CHANGED",
            "temporalScore": 7.1,
            "userInteraction": "REQUIRED",
            "vectorString": "CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:C/C:L/I:H/A:H/E:U/RL:O/RC:C",
            "version": "3.1"
          },
          "products": [
            "1",
            "2",
            "3",
            "4"
          ]
        }
      ],
      "threats": [
        {
          "category": "impact",
          "details": "Spoofing"
        },
        {
          "category": "exploit_status",
          "details": "Exploited:No;Latest Software Release:Exploitation Less Likely"
        }
      ],
      "title": "Service Fabric Explorer Spoofing Vulnerability"
    }
  ]
}