PT-2019-3903 · Microsoft · Office Online Server+1

Publicado 2019-11-12 · Atualizado 2020-08-24 · CVE-2019-1445

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Office Online (affected versions not specified) Office Online Server (affected versions not specified)

Description A spoofing issue exists due to incorrect validation of origin in cross-origin communications handlers. This can be exploited by a remote attacker using a specially crafted request to conduct spoofing attacks. The issue is related to errors in the representation of information by the user interface.

Recommendations For Office Online, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Office Online Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Origin Validation Error

UI Misrepresentation of Critical Information

Enumeração de Fraquezas

CWE-346

CWE-451

Identificadores relacionados

BDU:2019-04321

CVE-2019-1445

Produtos afetados

Office Online

Office Online Server

Referências · 4

• https://bdu.fstec.ru/vul/2019-04321 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2019-1445 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1445 · Aviso do Fabricante
• https://cybersecurity-help.cz/vdb/SB2019111210 · Nota