Vulnerability in Microsoft 365 Apps
CVE-2020-1502
An information disclosure vulnerability exists when Microsoft Word improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data. To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created. The update addresses the vulnerability by changing the way certain Word functions handle objects in memory.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 5.5 (Medium). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N.
EPSS exploit prediction
EPSS: 0.046 (91.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 91st percentile — 91.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.046 · newest: 0.046 · change: 0.000
Affected products
- Microsoft 365 Apps
- Microsoft 365 Apps For Enterprise — versions 16.0.1
- Microsoft Office 2019 — versions 19.0.0
- Microsoft Office Online Server — versions 16.0.1
- Microsoft Sharepoint Server 2019 — versions 16.0.0
- Microsoft Office — versions 2019
- Microsoft Office Online Server
- Microsoft Sharepoint Server — versions 2019
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1502 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-1502?
- CVE-2020-1502 is a medium-severity vulnerability in Microsoft 365 Apps. CVSS score: 5.5/10. Published 2020-08-17.
- How severe is CVE-2020-1502?
- Medium severity. CVSS v3 base score is 5.5 out of 10.