PT-2019-2684 · Microsoft · Office

Publicado 2019-07-09 · Atualizado 2019-07-29 · CVE-2019-1109

Positive Technologies (AI Summary)

CVSS v3.1

9.1

Crítica

Vetor base

AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified)

Description A spoofing issue exists due to Microsoft Office Javascript not validating the web page requesting access to Office documents. This could allow an attacker to read or write information in Office documents. The security update corrects how Microsoft Office Javascript verifies trusted web pages.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Authentication Bypass by Spoofing

Enumeração de Fraquezas

CWE-20

CWE-290

Identificadores relacionados

BDU:2019-02571

CVE-2019-1109

Produtos afetados

Office

Referências · 7

• https://bdu.fstec.ru/vul/2019-02571 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1109 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1109 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1109 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2019-1109 · Aviso do Fabricante
• https://rapid7.com/db/vulnerabilities/msft-cve-2019-1109 · Nota
• https://mag-securs.com/alertes/artmid/1894/articleid/65303/microsoft-office-365-proplus2013-rt-sp12013-sp120162019-javascript-spoofing.aspx · Nota