PT-2020-1738 · Microsoft · Outlook

Published 2020-02-11 · Updated 2020-02-13 · CVE-2020-0696

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified)

Description A security feature bypass issue exists when Microsoft Outlook improperly handles the parsing of URI formats. This can allow a remote attacker to bypass existing security restrictions, redirect a user to a malicious URI, and potentially execute malicious code when combined with other vulnerabilities. The bypass by itself does not enable arbitrary code execution but can be exploited in conjunction with another vulnerability, such as a remote code execution vulnerability, to run arbitrary code. An attacker would need to convince a user to open a specially crafted URI with an affected version of Microsoft Outlook.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2020-00978

CVE-2020-0696

Affected Products

Outlook

References · 5

• https://osv.dev/vulnerability/CVE-2020-0696 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-0696 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0696 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-00978 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0696; · Note