Описание
Microsoft Office Security Feature Bypass Vulnerability
FAQ
Is the Attachment Preview Pane an attack vector for this vulnerability?
Yes. The attachment Preview Pane that is accessed when a user clicks to preview an attached file is an attack vector; however, the email Preview Pane itself is not.
What kind of security feature could be bypassed by successfully exploiting this vulnerability?
The attacker would be able to bypass the protection in Outlook that prevents a potentially dangerous extension from being uploaded and downloaded.
According to the CVSS metrics, successful exploitation of this vulnerability could lead to no loss of confidentiality (C:N), with minor loss of integrity (I:N) and availability (A:L). What does that mean for this vulnerability?
While we cannot rule out the impact to Confidentiality, Integrity, and Availability, the ability to exploit this vulnerability by itself is limited. An attacker would need to combine this with other vulnerabilities to perform an attack.
Обновления
| Продукт | Статья | Обновление |
|---|---|---|
| Microsoft Office 2013 Service Pack 1 (32-bit editions) | ||
| Microsoft Office 2013 Service Pack 1 (64-bit editions) | ||
| Microsoft Office 2013 RT Service Pack 1 | - | |
| Microsoft Office 2016 (32-bit edition) | ||
| Microsoft Office 2016 (64-bit edition) | ||
| Microsoft Office 2019 for 32-bit editions | - | |
| Microsoft Office 2019 for 64-bit editions | - | |
| Microsoft Office 2019 for Mac | ||
| Microsoft 365 Apps for Enterprise for 32-bit Systems | - | |
| Microsoft 365 Apps for Enterprise for 64-bit Systems | - |
Показывать по
Возможность эксплуатации
Publicly Disclosed
Exploited
Latest Software Release
DOS
EPSS
4.3 Medium
CVSS3
Связанные уязвимости
Microsoft Office Security Feature Bypass Vulnerability
Уязвимость пакета программ Microsoft Office, связанная с ошибками в настройках безопасности, позволяющая нарушителю обойти существующие ограничения безопасности
EPSS
4.3 Medium
CVSS3