PT-2021-1818 · Microsoft · 365 Apps+5

Jinquan

·

Published

2021-01-12

·

Updated

2024-10-08

·

CVE-2021-1714

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions: Microsoft Excel (affected versions not specified) Microsoft 365 Apps (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft Office Online Server (affected versions not specified) Microsoft Office Web Apps (affected versions not specified) Microsoft SharePoint Enterprise Server (affected versions not specified)
Description: The issue is related to insufficient input validation in Microsoft Excel, allowing a remote attacker to execute arbitrary code. This can be exploited by attackers to gain unauthorized access and execute malicious code.
Recommendations: For Microsoft Excel, consider disabling any features that rely on external input until a patch is available. For Microsoft 365 Apps, restrict access to any modules or functions that may be vulnerable to input validation attacks. For Microsoft Office, Microsoft Office Online Server, Microsoft Office Web Apps, and Microsoft SharePoint Enterprise Server, apply configuration changes to minimize the risk of exploitation, such as limiting user permissions and restricting access to sensitive data. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2021-00574
CVE-2021-1714

Affected Products

365 Apps
Office Excel
Office
Office Online Server
Office Web Apps
Sharepoint Server