Vulnerability in Microsoft 365 Apps
CVE-2020-1493
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting. The security update addresses the vulnerability by correcting how Outlook handles file attachment links.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.073 (94.3th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 94th percentile — 94.3% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.073 · newest: 0.073 · change: 0.000
Affected products
- Microsoft 365 Apps
- Microsoft 365 Apps For Enterprise — versions 16.0.1
- Microsoft Office 2019 — versions 19.0.0
- Microsoft Outlook 2010 Service Pack 2 — versions 13.0.0.0
- Microsoft Outlook 2013 Service Pack 1 — versions 15.0.0.0
- Microsoft Outlook 2016 — versions 16.0.0.0
- Microsoft Office — versions 2019
- Microsoft Outlook — versions 2010, 2013, 2016
Weakness classification (CWE)
Public proof-of-concept exploits
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1493 (Patch, Vendor Advisory)
- packetstormsecurity.com/files/169960/Microsoft-Outlook-2019-16.0.12624.20424-Ou… (VDB Entry, Third Party Advisory)
Frequently asked questions
- What is CVE-2020-1493?
- CVE-2020-1493 is a medium-severity vulnerability in Microsoft 365 Apps, classified under CWE-922. CVSS score: 5.5/10. Published 2020-08-17.
- How severe is CVE-2020-1493?
- Medium severity. CVSS v3 base score is 5.5 out of 10.
- Is CVE-2020-1493 known to be exploited?
- 9 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.