PT-2020-3200 · Microsoft · Sharepoint Server+2

Published 2020-07-14 · Updated 2021-07-21 · CVE-2020-1448

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft SharePoint (affected versions not specified)

Description The issue is related to the incorrect handling of objects in memory, which can be exploited by a remote attacker to execute arbitrary code using a specially crafted file. To exploit the issue, a user must open the specially crafted file with an affected version of the software. This can allow the attacker to perform actions in the security context of the current user.

Recommendations For Microsoft Word, consider avoiding the use of specially crafted files until a fix is available. For Microsoft Office, restrict the opening of suspicious files to minimize the risk of exploitation. For Microsoft SharePoint, consider implementing additional security measures to prevent the upload and sharing of specially crafted files. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Buffer Overflow

Weakness Enumeration

CWE-119

Related Identifiers

BDU:2020-03498

CVE-2020-1448

Affected Products

Office

Sharepoint Server

Office Word

References · 8

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1448 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-03498 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1448 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1448 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-1448 · Security Note
• https://t.me/cvenotify/5021 · Telegram Post
• https://t.me/cvenotify/5020 · Telegram Post
• https://t.me/cvenotify/5019 · Telegram Post