PT-2020-2809 · Microsoft · Office Project

Published 2020-06-09 · Updated 2021-07-21 · CVE-2020-1322

Positive Technologies (AI Summary)

CVSS v2.0

7.1

High

Base vector

AV:N/AC:M/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Project (affected versions not specified)

Description An information disclosure issue exists due to Microsoft Project reading out of bound memory caused by an uninitialized variable. This could allow a remote attacker to gain unauthorized access to protected information. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Project, potentially allowing the attacker to view sensitive information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Information Disclosure

Use of Uninitialized Resource

Weakness Enumeration

CWE-125

CWE-200

CWE-908

Related Identifiers

BDU:2020-02937

CVE-2020-1322

Affected Products

Office Project

References · 5

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1322 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-02937 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1322 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1322 · Security Note
• https://t.me/cvenotify/4256 · Telegram Post