PT-2022-5639 · Microsoft · Office+2

Jdgregson · Published 2022-11-08 · Updated 2023-05-19 · CVE-2022-41104

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Excel (affected versions not specified) Microsoft Office (affected versions not specified) Microsoft 365 Apps for Enterprise (affected versions not specified)

Description The issue is related to errors in security settings, allowing an attacker to disclose protected information using a specially crafted file. It is a security-feature bypass vulnerability that enables attackers to affect the system.

Recommendations For Microsoft Excel, consider restricting access to sensitive files until a fix is available. For Microsoft Office, avoid using features that rely on security settings until the issue is resolved. For Microsoft 365 Apps for Enterprise, as a temporary workaround, consider disabling any functionality that may be exploited due to the security-feature bypass vulnerability until a patch is available. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2022-07007

CVE-2022-41104

Affected Products

365 Apps For Enterprise

Office Excel

Office

References · 6

• https://msrc.microsoft.com/update-guide/vulnerability/CVE-2022-41104 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2022-41104 · Security Note
• https://osv.dev/vulnerability/CVE-2022-41104 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41104 · Security Note
• https://bdu.fstec.ru/vul/2022-07007 · Security Note
• https://t.me/cvenotify/37517 · Telegram Post