PT-2020-4282 · Microsoft · Office Word

Published 2020-10-13 · Updated 2023-12-31 · CVE-2020-16933

Positive Technologies (AI Summary)

CVSS v3.1

7.0

High

Base vector

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Microsoft Word (affected versions not specified)

Description: A security feature bypass issue exists in Microsoft Word software when it fails to properly handle .LNK files. An attacker who successfully exploited the issue could use a specially crafted file to perform actions in the security context of the current user. The issue can be exploited by opening a specially crafted file with an affected version of Microsoft Word software. Attack scenarios include email attacks, where an attacker sends the specially crafted file to the user and convinces the user to open it, and web-based attacks, where an attacker hosts a website with a specially crafted file designed to exploit the issue.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2020-04774

CVE-2020-16933

Affected Products

Office Word

References · 6

• https://bdu.fstec.ru/vul/2020-04774 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-16933 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-16933 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2020-16933 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2020-16933 · Security Note
• https://cybersecurity-help.cz/vdb/SB2020101357 · Note