PT-2020-1672 · Microsoft · Office

Zhiniang Peng · Published 2020-02-11 · Updated 2021-07-21 · CVE-2020-0697

Positive Technologies (AI Summary)

CVSS v2.0

7.2

High

Base vector

AV:L/AC:L/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified)

Description The issue is related to insecure privilege management in the OLicenseHeartbeat task of Microsoft Office. An attacker who successfully exploits this could run the task as SYSTEM, potentially allowing them to elevate their privileges. To exploit the issue, an authenticated attacker would need to place a specially crafted file in a specific location, which could lead to arbitrary file corruption.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Privilege Management

Weakness Enumeration

CWE-269

Related Identifiers

BDU:2020-00905

CVE-2020-0697

Affected Products

Office

References · 3

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0697 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0697 · Security Note
• https://bdu.fstec.ru/vul/2020-00905 · Security Note