Lucene search

[email protected]CVE-2020-1563

HistoryAug 17, 2020 - 7:15 p.m.

CVE-2020-1563

2020-08-1719:15:20

[email protected]

web.nvd.nist.gov

cve-2020-1563

remote code execution

microsoft office

vulnerability

nvd

9.3 High

CVSS2

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

7.8 High

CVSS3

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

8 High

AI Score

Confidence

High

0.015 Low

EPSS

Percentile

87.1%

JSON

A remote code execution vulnerability exists in Microsoft Office software when the software fails to properly handle objects in memory. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. Users whose accounts are configured to have fewer user rights on the system could be less impacted than users who operate with administrative user rights.
Exploitation of the vulnerability requires that a user open a specially crafted file with an affected version of Microsoft Office. In an email attack scenario, an attacker could exploit the vulnerability by sending the specially crafted file to the user and convincing the user to open the file.
The security update addresses the vulnerability by correcting how Microsoft Office handles objects in memory.

Affected configurations

Vulners

NVD

Node

microsoftmicrosoft_office_2019Match19.0.0

microsoft365_appsMatch16.0.1

microsoftmicrosoft_office_2016Match16.0.0

microsoftofficeRange13.0.0.0–2010service

microsoftofficeRange15.0.0–2013service

VendorProductVersionCPE
microsoftmicrosoft_office_201919.0.0cpe:2.3:a:microsoft:microsoft_office_2019:19.0.0:*:*:*:*:*:*:*
microsoft365_apps16.0.1cpe:2.3:a:microsoft:365_apps:16.0.1:*:*:*:*:*:*:*
microsoftmicrosoft_office_201616.0.0cpe:2.3:a:microsoft:microsoft_office_2016:16.0.0:*:*:*:*:*:*:*
microsoftoffice*cpe:2.3:a:microsoft:office:*:*:*:*:service:*:*:*
microsoftoffice*cpe:2.3:a:microsoft:office:*:*:*:*:service:*:*:*

Vendor	Product	Version	CPE
microsoft	microsoft_office_2019	19.0.0	cpe:2.3:a:microsoft:microsoft_office_2019:19.0.0:::::::*
microsoft	365_apps	16.0.1	cpe:2.3:a:microsoft:365_apps:16.0.1:::::::*
microsoft	microsoft_office_2016	16.0.0	cpe:2.3:a:microsoft:microsoft_office_2016:16.0.0:::::::*
microsoft	office	*	cpe:2.3:a:microsoft:office:::::service:::*
microsoft	office	*	cpe:2.3:a:microsoft:office:::::service:::*

CNA Affected

[
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2019",
    "cpes": [
      "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "19.0.0",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft 365 Apps for Enterprise",
    "cpes": [
      "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.1",
        "lessThan": "https://aka.ms/OfficeSecurityReleases",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2016",
    "cpes": [
      "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x86:*",
      "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:x64:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "16.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2010 Service Pack 2",
    "cpes": [
      "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*"
    ],
    "platforms": [
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "13.0.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  },
  {
    "vendor": "Microsoft",
    "product": "Microsoft Office 2013 Service Pack 1",
    "cpes": [
      "cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*",
      "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x86:*",
      "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x64:*"
    ],
    "platforms": [
      "ARM64-based Systems",
      "32-bit Systems",
      "x64-based Systems"
    ],
    "versions": [
      {
        "version": "15.0.0",
        "lessThan": "publication",
        "versionType": "custom",
        "status": "affected"
      }
    ]
  }
]