PT-2021-5600 · Microsoft · Office+2

Linhlhq · Published 2021-07-13 · Updated 2024-03-21 · CVE-2021-34452

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions Microsoft Office versions (affected versions not specified) Microsoft Word versions (affected versions not specified) Microsoft 365 Apps for Enterprise versions (affected versions not specified)

Description The issue is related to insufficient input validation in Microsoft Office, Microsoft Word, and Microsoft 365 Apps for Enterprise, allowing an attacker to execute arbitrary code. This can be exploited by remote attackers, potentially affecting the system.

Recommendations For Microsoft Office, update to a version that includes the fix for this issue. For Microsoft Word, consider disabling any features that rely on external input until a patch is available. For Microsoft 365 Apps for Enterprise, restrict access to any modules that may be vulnerable to remote code execution until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2022-00034

CVE-2021-34452

Affected Products

365 Apps For Enterprise

Office

Office Word

References · 9

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-34452 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-34452 · Security Note
• https://bdu.fstec.ru/vul/2022-00034 · Security Note
• https://safe-surf.ru/specialists/base-vulnerabilities/668160 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2021-34452 · Security Note
• https://safe-surf.ru/specialists/bulletins-nkcki/667115 · Security Note
• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-34452 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2021-34452 · Vendor Advisory
• https://t.me/cvenotify/74360 · Telegram Post