Lucene search
K
Database
Vendors
Products
Years
CVSS
Scanner
Agent Scanning
API Scanning
Manual Audit
Perimeter Scanner
Scanning
Projects
Email
Webhook
Plugins
Resources
Documents
Blog
Glossary
FAQ
Pricing
Contacts
About Us
Partners
Branding Guideline
kasperskyKaspersky LabKLA12109
HistoryMar 09, 2021 - 12:00 a.m.

KLA12109 Multiple vulnerabilities in Microsoft Office

2021-03-0900:00:00
Kaspersky Lab
threats.kaspersky.com
29

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.339 Low

EPSS

Percentile

97.0%

JSON

Detect date:

03/09/2021

Severity:

High

Description:

Multiple vulnerabilities were found in Microsoft Office. Malicious users can exploit these vulnerabilities to spoof user interface, execute arbitrary code, obtain sensitive information, bypass security restrictions.

Exploitation:

Malware exists for this vulnerability. Usually such malware is classified as Exploit. More details.

Affected products:

Microsoft Office 2016 (64-bit edition)
Microsoft Office Web Apps Server 2013 Service Pack 1
Microsoft Visio 2016 (32-bit edition)
Microsoft Office 2016 (32-bit edition)
Microsoft Excel 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2013 Service Pack 1 (32-bit editions)
Microsoft PowerPoint 2013 Service Pack 1 (64-bit editions)
Microsoft Visio 2016 (64-bit edition)
Microsoft PowerPoint 2010 Service Pack 2 (32-bit editions)
Microsoft PowerPoint 2016 (64-bit edition)
Microsoft Office 2010 Service Pack 2 (64-bit editions)
Microsoft Excel 2016 (32-bit edition)
Microsoft Office 2019 for 32-bit editions
Microsoft Excel 2013 RT Service Pack 1
Microsoft PowerPoint 2016 (32-bit edition)
Microsoft 365 Apps for Enterprise for 32-bit Systems
Microsoft Office 2019 for Mac
Microsoft Business Productivity Servers 2010 Service Pack 2
Microsoft SharePoint Foundation 2013 Service Pack 1
Microsoft Excel 2013 Service Pack 1 (64-bit editions)
Microsoft Visio 2010 Service Pack 2 (64-bit editions)
Microsoft PowerPoint 2010 Service Pack 2 (64-bit editions)
Microsoft Excel 2016 (64-bit edition)
Microsoft Office 2010 Service Pack 2 (32-bit editions)
Microsoft Visio 2013 Service Pack 1 (32-bit editions)
Microsoft Office Web Apps 2013 Service Pack 1
Microsoft SharePoint Enterprise Server 2016
Microsoft 365 Apps for Enterprise for 64-bit Systems
Microsoft Excel 2013 Service Pack 1 (32-bit editions)
Microsoft Office Online Server
Microsoft SharePoint Server 2019
Microsoft PowerPoint 2013 RT Service Pack 1
Microsoft Visio 2010 Service Pack 2 (32-bit editions)
Microsoft Office 2013 RT Service Pack 1
Microsoft Office 2013 Service Pack 1 (64-bit editions)
Microsoft Excel 2010 Service Pack 2 (64-bit editions)
Microsoft PowerPoint 2013 Service Pack 1 (32-bit editions)
Microsoft Office 2019 for 64-bit editions
Microsoft Visio 2013 Service Pack 1 (64-bit editions)

Solution:

Install necessary updates from the KB section, that are listed in your Windows Update (Windows Update usually can be accessed from the Control Panel)

Original advisories:

CVE-2021-24104
CVE-2021-27053
CVE-2021-27052
CVE-2021-27059
CVE-2021-27054
CVE-2021-27055
CVE-2021-27057
CVE-2021-27056
CVE-2021-27058
CVE-2021-27076
CVE-2021-24108

Impacts:

ACE

Related products:

Microsoft Visio 2010

CVE-IDS:

CVE-2021-241044.6Warning
CVE-2021-270537.8Critical
CVE-2021-270525.3High
CVE-2021-270597.6Critical
CVE-2021-270547.8Critical
CVE-2021-270557.0High
CVE-2021-270577.8Critical
CVE-2021-270567.8Critical
CVE-2021-270587.8Critical
CVE-2021-270768.8Critical
CVE-2021-241087.8Critical

KB list:

4493228
4493214
4484376
4493224
4493177
4493227
4493225
4504703
4493239
4493231
4493238
4493232
4493233
4493234
4493199
4493229
4493203
4486673
4493151
4504702
4504707
4493200
3101541
4493230

Microsoft official advisories:

References

Related

openvas 17
nessus 15
mskb 24
attackerkb 2
prion 11
cve 11
mscve 11
zdi 5
cisa_kev 1
checkpoint_advisories 1
rapid7blog 1
threatpost 1
thn 1
qualysblog 2
openvas
openvas
Microsoft Office 365 (2016 Click-to-Run) Multiple Vulnerabilities (Mar 2021)
2021-03-15 00:00:00
Microsoft Excel 2016 Multiple Remote Code Execution Vulnerabilities (KB4493233)
2021-03-10 00:00:00
Microsoft Excel 2013 Service Pack 1 Remote Code Execution Vulnerabilities (KB4493239)
2021-03-10 00:00:00
nessus
nessus
Security Updates for Microsoft Office Products (March 2021)
2021-03-09 00:00:00
Security Updates for Microsoft SharePoint Server 2019 (March 2021)
2021-03-12 00:00:00
Security Updates for Microsoft Excel Products C2R (March 2021)
2022-06-10 00:00:00
mskb
mskb
Description of the security update for Excel 2013: March 9, 2021 (KB4493239)
2021-03-09 08:00:00
Description of the security update for Excel 2010: March 9, 2021 (KB4504707)
2021-03-09 08:00:00
Description of the security update for SharePoint Enterprise Server 2016: March 9, 2021 (KB4493232)
2021-03-09 08:00:00
attackerkb
attackerkb
CVE-2021-27059
2021-03-11 00:00:00
CVE-2021-27076
2021-03-11 00:00:00
prion
prion
Remote code execution
2021-03-11 16:15:00
Remote code execution
2021-03-11 16:15:00
Security feature bypass
2021-03-11 16:15:00
cve
cve
CVE-2021-27058
2021-03-11 16:15:00
CVE-2021-27052
2021-03-11 16:15:00
CVE-2021-24108
2021-03-11 16:15:00
mscve
mscve
Microsoft SharePoint Server Information Disclosure Vulnerability
2021-03-09 08:00:00
Microsoft Office ClickToRun Remote Code Execution Vulnerability
2021-03-09 08:00:00
Microsoft PowerPoint Remote Code Execution Vulnerability
2021-03-09 08:00:00
zdi
zdi
Microsoft Excel XLS File Parsing Use-After-Free Remote Code Execution Vulnerability
2021-03-17 00:00:00
Microsoft PowerPoint PPTX File Parsing Use-After-Free Remote Code Execution Vulnerability
2021-03-17 00:00:00
Microsoft Office Graph Uninitialized Variable Remote Code Execution Vulnerability
2021-03-17 00:00:00
cisa_kev
cisa_kev
Microsoft Office Remote Code Execution Vulnerability
2021-11-03 00:00:00
checkpoint_advisories
checkpoint_advisories
Microsoft SharePoint Server Remote Code Execution (CVE-2021-27076)
2021-03-09 00:00:00
rapid7blog
rapid7blog
Patch Tuesday - March 2021
2021-03-09 22:13:03
threatpost
threatpost
Microsoft Patch Tuesday Updates Fix 14 Critical Bugs
2021-03-09 22:12:56
thn
thn
Microsoft Issues Security Patches for 89 Flaws — IE 0-Day Under Active Attacks
2021-03-10 05:37:00
qualysblog
qualysblog
Qualys Response to CISA Alert: Binding Operational Directive 22-01
2021-11-09 06:15:01
Managing CISA Known Exploited Vulnerabilities with Qualys VMDR
2022-02-23 05:39:00

8.8 High

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

NONE

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.1/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

8.1 High

AI Score

Confidence

High

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.339 Low

EPSS

Percentile

97.0%

JSON
Related for KLA12109
openvas17nessus15mskb24attackerkb2prion11cve11mscve11zdi5cisa_kev1checkpoint_advisories1rapid7blog1threatpost1thn1qualysblog2