PT-2019-3189 · Microsoft · Office Project+2

Published 2019-09-10 · Updated 2019-09-12 · CVE-2019-1264

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified) Office 365 (affected versions not specified) Microsoft Project (affected versions not specified)

Description A security feature bypass issue exists due to improper handling of input in Microsoft Office, allowing an attacker to execute arbitrary commands by exploiting the vulnerability. The vulnerability can be exploited through a specially crafted file.

Recommendations For Microsoft Office, consider implementing additional input validation mechanisms until a patch is available. For Office 365, restrict access to potentially vulnerable features to minimize the risk of exploitation. For Microsoft Project, avoid using potentially vulnerable functions until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-03178

CVE-2019-1264

Affected Products

Office

Office Project

Office 365

References · 5

• https://bdu.fstec.ru/vul/2019-03178 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1264 · Security Note
• https://osv.dev/vulnerability/CVE-2019-1264 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2019-1264 · Security Note