Vulnerability in Microsoft 365 Apps
CVE-2020-1581
An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) components handle objects in memory. An attacker who successfully exploited the vulnerability could elevate privileges. The attacker would need to already have the ability to execute code on the system. An attacker could exploit this vulnerability by running a specially crafted application on the victim system. The security update addresses the vulnerability by correcting how Microsoft Office Click-to-Run (C2R) components handle objects in memory.
Published · last modified .
CVSS v3 metric
CVSS v3 base score 7.8 (High). Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H.
EPSS exploit prediction
EPSS: 0.037 (89.4th percentile), scored .
Low probability of exploitation in the next 30 days, but still tracked. 89th percentile — 89.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.037 · newest: 0.037 · change: 0.000
Affected products
- Microsoft 365 Apps
- Microsoft 365 Apps For Enterprise — versions 16.0.1
- Microsoft Office 2013 Click-To-Run (C2r) — versions 15.0.0.0
- Microsoft Office 2019 — versions 19.0.0
- Microsoft Office — versions 2013, 2019
References
- portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1581 (Patch, Vendor Advisory)
Frequently asked questions
- What is CVE-2020-1581?
- CVE-2020-1581 is a high-severity vulnerability in Microsoft 365 Apps. CVSS score: 7.8/10. Published 2020-08-17.
- How severe is CVE-2020-1581?
- High severity. CVSS v3 base score is 7.8 out of 10.