Lucene search

[email protected]CVE-2020-1493

HistoryAug 17, 2020 - 7:15 p.m.

CVE-2020-1493

2020-08-1719:15:00

NVD-CWE-noinfo

[email protected]

web.nvd.nist.gov

cve

2020

1493

outlook

attachment

information disclosure

vulnerability

nvd

5.5 Medium

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

NONE

Availability Impact

NONE

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

5.2 Medium

AI Score

Confidence

High

4.3 Medium

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

0.003 Low

EPSS

Percentile

68.7%

JSON

An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users.
To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting.
The security update addresses the vulnerability by correcting how Outlook handles file attachment links.

VendorProductVersionCPE
microsoftmicrosoft_office_201919.0.0cpe:2.3:a:microsoft:microsoft_office_2019:19.0.0:*:*:*:*:*:*:*
microsoft365_apps16.0.1cpe:2.3:a:microsoft:365_apps:16.0.1:*:*:*:*:*:*:*
microsoftmicrosoft_outlook_201616.0.0.0cpe:2.3:a:microsoft:microsoft_outlook_2016:16.0.0.0:*:*:*:*:*:*:*
microsoftmicrosoft_outlook_2013_sp115.0.0.0cpe:2.3:a:microsoft:microsoft_outlook_2013_sp1:15.0.0.0:sp1:*:*:*:*:*:*
microsoftmicrosoft_outlook_2010_sp213.0.0.0cpe:2.3:a:microsoft:microsoft_outlook_2010_sp2:13.0.0.0:sp2:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	microsoft_office_2019	19.0.0	cpe:2.3:a:microsoft:microsoft_office_2019:19.0.0:::::::*
microsoft	365_apps	16.0.1	cpe:2.3:a:microsoft:365_apps:16.0.1:::::::*
microsoft	microsoft_outlook_2016	16.0.0.0	cpe:2.3:a:microsoft:microsoft_outlook_2016:16.0.0.0:::::::*
microsoft	microsoft_outlook_2013_sp1	15.0.0.0	cpe:2.3:a:microsoft:microsoft_outlook_2013_sp1:15.0.0.0:sp1::::::
microsoft	microsoft_outlook_2010_sp2	13.0.0.0	cpe:2.3:a:microsoft:microsoft_outlook_2010_sp2:13.0.0.0:sp2::::::