🛡️ CVE-2023-37524 — traveler-for-microsoft-outlook

How this vulnerability can be exploited

This issue can be reached with local access to the system, attack complexity is high, an attacker needs no privileges on the target. A user must be tricked into taking some action. The scope is changed, meaning a successful attack can affect components beyond the vulnerable one. Rated impact: confidentiality high, integrity high, availability high.

CVSS metrics in full

The score comes from this vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:C/C:H/I:H/A:H

• Attack vector: Local — a local account, shell or session on the host is needed.
• Attack complexity: High — the attacker first has to win a race, learn a secret or otherwise prepare the target.
• Privileges required: None — an unauthenticated stranger can try it.
• User interaction: Required — someone has to click, open or visit something.
• Scope: Changed — a successful attack reaches components beyond the vulnerable one.
• Confidentiality impact: High — total loss, or loss the attacker controls.
• Integrity impact: High — total loss, or loss the attacker controls.
• Availability impact: High — total loss, or loss the attacker controls.

Weakness class

CVE-2023-37524 is classified as CWE-1104: Use of Unmaintained Third Party Components. The product relies on third-party components that are not actively supported or maintained by the original developer or a trusted proxy for the original developer.

Affected software

CVE-2023-37524 is recorded against 1 package.

• traveler-for-microsoft-outlook (fixed in 3.0.6)

Timeline and source

Published on 27 June 2026 and last revised on 6 July 2026. No public exploit is currently recorded for this entry. Record sourced from NVD.

References

support.hcl-software.com

Other advisories for this package

traveler-for-microsoft-outlook has other advisories on record. If you are patching this one, these are worth checking on the same host:

• CVE-2025-59868 (5.5 Medium, published 27 Jun 2026)
• CVE-2024-23581 (6.7 Medium, published 26 Jun 2026)
• CVE-2024-42192 (5.5 Medium, published 16 Oct 2025)
• CVE-2024-42191 (6.5 Medium, published 30 May 2025)
• CVE-2024-42190 (6.5 Medium, published 30 May 2025)
• CVE-2024-30133 (5.3 Medium, published 12 Nov 2024)
• CVE-2024-30134 (6.7 Medium, published 26 Sep 2024)

Same weakness in other software

These advisories are the same class of weakness (CWE-1104: Use of Unmaintained Third Party Components) in other software:

• CVE-2026-16634 (9.8 Critical, published 24 Jul 2026)
• CVE-2026-60368 (8.8 High, published 22 Jul 2026)
• CVE-2026-56580 (2.2 Low, published 21 Jul 2026)
• CVE-2026-3031 (9.8 Critical, published 16 Jul 2026)
• CVE-2026-21821 (8.3 High, published 13 May 2026)
• CVE-2026-41468 (8.7 High, published 22 Apr 2026)
• CVE-2025-55277 (2.6 Low, published 26 Mar 2026)
• CVE-2025-20010 (7.8 High, published 11 Nov 2025)

Details

Affected Packages

References