PT-2020-3217 · Microsoft · Sharepoint Server+4

Published 2020-07-14 · Updated 2021-07-21 · CVE-2020-1342

Positive Technologies (AI Summary)

CVSS v2.0

6.8

Medium

Base vector

AV:N/AC:L/Au:S/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Office (affected versions not specified) Microsoft Office Online Server (affected versions not specified) Microsoft Office Web Apps Server (affected versions not specified) Microsoft SharePoint Server (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified) Microsoft Word (affected versions not specified)

Description An information disclosure issue exists due to Microsoft Office software reading out of bound memory because of an uninitialized variable. This could disclose the contents of memory. Exploitation of the issue requires a user to open a specially crafted file with an affected version of Microsoft Office software, potentially allowing a remote attacker to gain unauthorized access to protected information.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Out of bounds Read

Use of Uninitialized Resource

Weakness Enumeration

CWE-125

CWE-908

Related Identifiers

BDU:2020-03515

CVE-2020-1342

Affected Products

Office

Office Online Server

Office Web Apps Server

Sharepoint Server

Office Word

References · 6

• https://bdu.fstec.ru/vul/2020-03515 · Security Note
• https://osv.dev/vulnerability/CVE-2020-1342 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1342 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-1342 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2020-1342 · Security Note
• https://t.me/cvenotify/5018 · Telegram Post