PT-2020-2047 · Microsoft · Office+8

Published 2020-04-14 · Updated 2021-07-21 · CVE-2020-0760

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified)

Description A remote code execution issue exists due to Microsoft Office improperly loading arbitrary type libraries. This allows an attacker to install programs, view, change, or delete data, or create new accounts with full user rights by convincing a user to open a specially crafted Office document. Users with limited system rights are less impacted than those operating with administrative rights.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2020-01734

CVE-2020-0760

Affected Products

Office

Office Access

Office Excel

Office Powerpoint

Office Project

Office Publisher

Office Visio

Office Word

Outlook

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0760 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0760 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-0760 · Security Note
• https://osv.dev/vulnerability/CVE-2020-0760 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/648016 · Security Note
• https://bdu.fstec.ru/vul/2020-01734 · Security Note
• https://t.me/cibsecurity/11270 · Telegram Post