FKIE_CVE-2020-0760

Vulnerability from fkie_nvd - Published: 2020-04-15 15:15 - Updated: 2024-11-21 04:54
Severity ?
8.8 (High) - CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Summary
A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka 'Microsoft Office Remote Code Execution Vulnerability'. This CVE ID is unique from CVE-2020-0991.
References
secure@microsoft.comhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0760Patch, Vendor Advisory
af854a3a-2127-422b-91ae-364da2661108https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0760Patch, Vendor Advisory
Impacted products
Vendor Product Version
microsoft access 2010
microsoft access 2013
microsoft access 2016
microsoft excel 2010
microsoft excel 2013
microsoft excel 2016
microsoft office 2010
microsoft office 2013
microsoft office 2013
microsoft office 2016
microsoft office 2019
microsoft office_365_proplus -
microsoft outlook 2010
microsoft outlook 2013
microsoft outlook 2013
microsoft outlook 2016
microsoft powerpoint 2010
microsoft powerpoint 2013
microsoft powerpoint 2013
microsoft powerpoint 2016
microsoft project 2010
microsoft project 2013
microsoft project 2016
microsoft publisher 2010
microsoft publisher 2013
microsoft publisher 2016
microsoft visio 2010
microsoft visio 2013
microsoft visio 2016
microsoft word 2010
microsoft word 2013
microsoft word 2013
microsoft word 2016
To clipboard 

{
  "configurations": [
    {
      "nodes": [
        {
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:access:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "7122C5BF-C7C8-4B20-AACF-03F0ED83A7A4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:access:2013:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "3E995599-F698-4E73-9401-4CA47FADFCBE",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:access:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "0E42DC73-F1D0-47CD-BED8-DB2C6E044E2D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "E36D981E-E56D-46C7-9486-FC691A75C497",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:rt:*:*:*",
              "matchCriteriaId": "3A062169-527E-43DA-8AE0-FD4FBA1B2A9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "09BF0981-749E-470B-A7AC-95AD087797EF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "081DE1E3-4622-4C32-8B9C-9AEC1CD20638",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:-:*:*:*",
              "matchCriteriaId": "552E1557-D6FA-45DD-9B52-E13ACDBB8A62",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*",
              "matchCriteriaId": "F7DDFFB8-2337-4DD7-8120-56CC8EF134B4",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "E0B3B0BC-C7C6-4687-AD72-DCA29FF9AE3A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*",
              "matchCriteriaId": "C5282C83-86B8-442D-851D-B54E88E8B1F1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*",
              "matchCriteriaId": "CA035812-F35A-43F1-9A8D-EE02201AA10A",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "F9A115C1-45EB-4688-AD7C-C1854850EE9B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:-:*:*:*",
              "matchCriteriaId": "8D513A61-6427-4F85-AADF-99D6F223AF2B",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*",
              "matchCriteriaId": "DDA98A76-D0D1-4BFA-BEAC-1C2313F7B859",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "E2B1657C-0FF4-461A-BE2A-641275C4B0A0",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "9CCB2D72-B779-4772-8F72-7177E3F47A92",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2013:sp1:*:*:-:*:*:*",
              "matchCriteriaId": "F7F40F5A-E53D-430A-B3CA-8836288FE47E",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2013:sp1:*:*:rt:*:*:*",
              "matchCriteriaId": "36A1FA52-BFBD-4C88-9CBE-B68E55C75726",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:powerpoint:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "C971A8FC-3897-496D-BB9A-9E6C8A03AEA1",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "39EA4DCC-AA3F-4E3B-8754-BF79B2FD8657",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project:2013:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "33E26FF2-B80D-4C64-B9D5-ED0DE4BF3B1F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "5AA3A3C2-DB00-4095-B445-5A5041EB3194",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "78E9611F-1DE1-4FB2-9C70-16602FFC73C7",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2013:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "EB39B6EE-BC01-4D21-A3D8-CDDA268C55FF",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:publisher:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "AB3AA120-CE06-40A3-ADC4-C42077509287",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "ED0408B6-4FB5-45E9-AD27-301FC383152D",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2013:sp1:*:*:*:*:*:*",
              "matchCriteriaId": "87EBA8C7-E317-4EFD-B1AA-DD6A8B0DFDCC",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visio:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "89229922-0836-4CC2-AED2-107C3142D0EA",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*",
              "matchCriteriaId": "24EEDAD9-9656-4B21-82E4-D60B83777492",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2013:sp1:*:*:-:*:*:*",
              "matchCriteriaId": "D7A48E44-F01A-40AD-B8AF-8FE368248003",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*",
              "matchCriteriaId": "45E21528-4B0F-4A6F-82AD-DF7FDBF67C8F",
              "vulnerable": true
            },
            {
              "criteria": "cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*",
              "matchCriteriaId": "4DA042D4-B14E-4DDF-8423-DFB255679EFE",
              "vulnerable": true
            }
          ],
          "negate": false,
          "operator": "OR"
        }
      ]
    }
  ],
  "cveTags": [],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists when Microsoft Office improperly loads arbitrary type libraries, aka \u0027Microsoft Office Remote Code Execution Vulnerability\u0027. This CVE ID is unique from CVE-2020-0991."
    },
    {
      "lang": "es",
      "value": "Hay una vulnerabilidad de ejecuci\u00f3n de c\u00f3digo remota cuando Microsoft Office carga inapropiadamente bibliotecas de tipos arbitrarios, tambi\u00e9n se conoce como \"Microsoft Office Remote Code Execution Vulnerability\". Este ID de CVE es diferente de CVE-2020-0991."
    }
  ],
  "id": "CVE-2020-0760",
  "lastModified": "2024-11-21T04:54:09.390",
  "metrics": {
    "cvssMetricV2": [
      {
        "acInsufInfo": false,
        "baseSeverity": "MEDIUM",
        "cvssData": {
          "accessComplexity": "MEDIUM",
          "accessVector": "NETWORK",
          "authentication": "NONE",
          "availabilityImpact": "PARTIAL",
          "baseScore": 6.8,
          "confidentialityImpact": "PARTIAL",
          "integrityImpact": "PARTIAL",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "version": "2.0"
        },
        "exploitabilityScore": 8.6,
        "impactScore": 6.4,
        "obtainAllPrivilege": false,
        "obtainOtherPrivilege": false,
        "obtainUserPrivilege": false,
        "source": "nvd@nist.gov",
        "type": "Primary",
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "cvssData": {
          "attackComplexity": "LOW",
          "attackVector": "NETWORK",
          "availabilityImpact": "HIGH",
          "baseScore": 8.8,
          "baseSeverity": "HIGH",
          "confidentialityImpact": "HIGH",
          "integrityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "scope": "UNCHANGED",
          "userInteraction": "REQUIRED",
          "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "version": "3.1"
        },
        "exploitabilityScore": 2.8,
        "impactScore": 5.9,
        "source": "nvd@nist.gov",
        "type": "Primary"
      }
    ]
  },
  "published": "2020-04-15T15:15:13.777",
  "references": [
    {
      "source": "secure@microsoft.com",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0760"
    },
    {
      "source": "af854a3a-2127-422b-91ae-364da2661108",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0760"
    }
  ],
  "sourceIdentifier": "secure@microsoft.com",
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ],
      "source": "nvd@nist.gov",
      "type": "Primary"
    }
  ]
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or observed by the user.
  • Confirmed: The vulnerability has been validated from an analyst's perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: The vulnerability was observed as exploited by the user who reported the sighting.
  • Patched: The vulnerability was observed as successfully patched by the user who reported the sighting.
  • Not exploited: The vulnerability was not observed as exploited by the user who reported the sighting.
  • Not confirmed: The user expressed doubt about the validity of the vulnerability.
  • Not patched: The vulnerability was not observed as successfully patched by the user who reported the sighting.



Detection rules are retrieved from Rulezet.