PT-2021-2723 · Microsoft · Office Online Server+4

Published

2021-01-20

·

Updated

2023-12-29

·

CVE-2021-28454

CVSS v3.1

7.8

High

VectorAV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Name of the Vulnerable Software and Affected Versions Microsoft Excel (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft Office Web Apps Server (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified) Microsoft Office Online Server (affected versions not specified)
Description The issue is related to the implementation of syntax analysis for XLS file format in Microsoft Office packages, which involves a use-after-free memory error. This can be exploited by an attacker to execute arbitrary code using a specially crafted malicious webpage or file. The vulnerability allows remote attackers to execute arbitrary code.
Recommendations For Microsoft Excel, consider disabling the XLS file parsing functionality until a patch is available. For Microsoft Office, restrict access to potentially vulnerable components to minimize the risk of exploitation. For Microsoft Office Web Apps Server, Microsoft 365 Apps for Enterprise, and Microsoft Office Online Server, avoid using the vulnerable syntax analysis functionality for XLS files until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Use After Free

Weakness Enumeration

Related Identifiers

BDU:2021-02257
CVE-2021-28454
ZDI-21-410

Affected Products

365 Apps For Enterprise
Office Excel
Office
Office Online Server
Office Web Apps Server