PT-2019-1139 · Microsoft · Office Word+2

Etienne Stalmans + 2 · Published 2019-01-08 · Updated 2020-08-24 · CVE-2019-0561

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions: Microsoft Word versions (affected versions not specified) Office 365 ProPlus versions (affected versions not specified) Microsoft Office versions (affected versions not specified)

Description: An information disclosure issue exists due to improper use of Microsoft Word macro buttons. This could allow a remote attacker to read arbitrary files by crafting a special document file and convincing the user to open it. The attacker must know the location of the file they wish to access.

Recommendations: For Microsoft Word, consider disabling the use of macro buttons until a fix is available. For Office 365 ProPlus, restrict access to sensitive files that could be accessed through this vulnerability. For Microsoft Office, avoid opening specially crafted document files from untrusted sources. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2019-00165

CVE-2019-0561

Affected Products

Office

Office Word

Office 365 Proplus

References · 6

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0561 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-0561 · Security Note
• https://osv.dev/vulnerability/CVE-2019-0561 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-0561 · Security Note
• https://bdu.fstec.ru/vul/2019-00165 · Security Note
• http://securityfocus.com/bid/106399 · Note