CVE-2020-1224
Microsoft Excel Information Disclosure Vulnerability
- State
- Published
- Severity
- 5.5 Medium
- Published
- Sep 11, 2020
- Updated
- Aug 4, 2024
- Reserved
- Nov 4, 2019
Description
<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data.</p> <p>To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created.</p> <p>The update addresses the vulnerability by changing the way certain Excel functions handle objects in memory.</p>
Scores
| CVSS | Score | Vector | Source |
|---|---|---|---|
| 3.1 | 5.5 Medium | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:C | microsoft |
Weaknesses
The record names no weakness.
Affected Products
| Product | Versions |
|---|---|
Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft |
|
Microsoft Office 2019Microsoft |
|
Microsoft Office 2019 for MacMicrosoft |
|
Microsoft Office Online ServerMicrosoft |
|
Microsoft 365 Apps for EnterpriseMicrosoft |
|
Microsoft Excel 2016Microsoft |
|
Microsoft Office 2016 for MacMicrosoft |
|
Microsoft Excel 2010 Service Pack 2Microsoft |
|
Microsoft Excel 2013 Service Pack 1Microsoft |
|
Microsoft Office Web Apps 2013 Service Pack 1Microsoft |
|
References
Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.