Improper input validation in Microsoft Office 2019
CVE-2019-1204
An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could…
Vulnerability class: Drupalgeddon 2 (CVE-2018-7600)
EPSS: 0.044 (90.3th percentile) — read the EPSS interpretation.
CVSS v3 metric
CVSS v3 base score 4.3 (Medium). Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N.
Affected products
- Microsoft Office 2019 — versions 19.0.0
- Microsoft Outlook 2010 Service Pack 2 — versions 13.0.0.0
- Microsoft Outlook 2013 Service Pack 1 — versions 15.0.0.0
- Microsoft Outlook 2016 — versions 16.0.0.0
- Microsoft Office — versions 2019
- Microsoft Office 365 Proplus — versions 16.0.0
- Microsoft Office_365_proplus
- Microsoft Outlook — versions 2010, 2013, 2016
Weakness classification (CWE)
References
- secure@microsoft.com (Patch, x_refsource_MISC, Vendor Advisory)
Frequently asked questions
- What is CVE-2019-1204?
- CVE-2019-1204 is a medium-severity vulnerability in Microsoft Office 2019, classified under Improper Input Validation. CVSS score: 4.3/10. Published 2019-08-14.
- How severe is CVE-2019-1204?
- Medium severity. CVSS v3 base score is 4.3 out of 10.