PT-2020-2741 · Microsoft · Office+2

Published 2020-06-09 · Updated 2021-07-21 · CVE-2020-1229

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified)

Description A security feature bypass issue exists when Office fails to enforce security settings configured on a system. This could allow a remote attacker to bypass existing security restrictions. Exploitation requires a user to open a specially crafted image with an affected version of Microsoft Office software, potentially causing the system to load remote images and disclose the IP address of the targeted system to the attacker.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

BDU:2020-02821

CVE-2020-1229

Affected Products

Office

Outlook

Office Word

References · 5

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1229 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1229 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1229 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1229 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02821 · Security Note