Microsoft Patch Tuesday – June 2023

Patch Tuesday is once again upon us. As always, our team has put together the monthly Patch Tuesday Report to help you manage your update progress. The audit report gives you a quick and clear overview of your Windows machines and their patching status. The June 2023 edition of Patch Tuesday brings us 78 new fixes, with 6 rated as critical. We’ve listed the most important changes below.

⚡ TL;DR | Go Straight to the June 2023 Patch Tuesday Audit Report

Microsoft SharePoint Server Elevation of Privilege Vulnerability

Just like last month, the most noteworthy fixes are for SharePoint. Sharepoint got a total of 5 vulnerabilities fixed, one of which is critical.

CVE-2023-29357 is the most critical of the five with a CVSS base score of 9.8 and exploitation being listed as “More Likely”. However, this does come with a sidenote. If you have the AMSI integration feature enabled and use Microsoft Defender across your SharePoint Server farm(s) you are protected.

For the ones that do not, attackers who successfully exploited this vulnerability could gain administrator privileges. An attacker who has gained access to spoofed JWT authentication tokens can use them to execute a network attack which bypasses authentication and allows them to gain access to the privileges of an authenticated user without requiring privileges or user interaction.

The other vulnerabilities, CVE-2023-33129, CVE-2023-33130, CVE-2023-33132, and CVE-2023-33142 range from having a CVSS base score of 7.3 to 6.3 and are less likely to be exploited. They contain one denial of service, two spoofing, and one elevation of privilege vulnerability.

Microsoft Exchange Server Remote Code Execution Vulnerability

CVE-2023-28310 and CVE-2023-32031 are two RCE vulnerabilities that were fixed for Exchange. With a CVSS base score of 8 and 8.8, and not getting the critical tag from Microsoft, they are not the most severe vulnerabilities this month however, they shouldn’t be overlooked as they are the more likely targets of attackers.

For both vulnerabilities, the attacker does require authentication which is likely why they did not receive the critical tag. If authenticated, an attacker exploiting CVE-2023-28310 can achieve remote code execution via a PowerShell remoting session. If CVE-2023-32031 is exploited, the attacker would attempt to trigger malicious code in the context of the server’s account through a network call.

Run the Patch Tuesday June 2023 Audit

To help manage your update progress, we’ve created the Patch Tuesday Audit that checks if the assets in your network are on the latest patch updates. The report has been color-coded to see which machines are up-to-date and which ones still need to be updated. As always, system administrators are urged to update their environment as soon as possible to ensure all endpoints are secured.

The Lansweeper Patch Tuesday report is automatically added to Lansweeper Site. Lansweeper Sites is included in all our licenses without any additional cost and allows you to federate all your installations into one single view so all you need to do is look at one report, automatically added every patch Tuesday!

Patch Tuesday June 2023 CVE Codes & Titles

Receive the Latest Patch Tuesday Report for FREE Every Month

"*" indicates required fields

Email*

Hidden

EmailType

Hidden

IM – Conv Page – Processing

Hidden

IM – UTM_Campaign FC – Processing

Hidden

IM – UTM_Campaign LC – Processing

Hidden

IM – UTM_Content FC – Processing

Hidden

IM – UTM_Content LC – Processing

Hidden

IM – UTM_Medium FC – Processing

Hidden

IM – UTM_Medium LC – Processing

Hidden

IM – UTM_Source FC – Processing

Hidden

IM – UTM_Source LC – Processing

Hidden

IM – UTM_Term FC – Processing

Hidden

IM – UTM_Term LC – Processing

Hidden

gclid

Hidden

msclkid

Name

This field is for validation purposes and should be left unchanged.

Count Me In Submit