PT-2019-3905 · Microsoft · Office Online Server+1

Published 2019-11-12 · Updated 2020-08-24 · CVE-2019-1447

Positive Technologies (AI Summary)

CVSS v2.0

5.8

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:P/A:N

Name of the Vulnerable Software and Affected Versions Office Online (affected versions not specified) Office Online Server (affected versions not specified)

Description A spoofing issue exists due to incorrect validation of origin in cross-origin communications handlers. This can be exploited by a remote attacker using a specially crafted request, potentially allowing spoofing attacks. The issue is related to errors in the representation of information by the user interface.

Recommendations For Office Online, at the moment, there is no information about a newer version that contains a fix for this vulnerability. For Office Online Server, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Origin Validation Error

UI Misrepresentation of Critical Information

Weakness Enumeration

CWE-346

CWE-451

Related Identifiers

BDU:2019-04323

CVE-2019-1447

Affected Products

Office Online

Office Online Server

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1447 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2019-1447 · Security Note
• https://bdu.fstec.ru/vul/2019-04323 · Security Note
• https://cybersecurity-help.cz/vdb/SB2019111210 · Note