CVE-2020-1224

Microsoft Excel Information Disclosure Vulnerability

State
Published
Severity
5.5 Medium
Published
Sep 11, 2020
Updated
Aug 4, 2024
Reserved
Nov 4, 2019

Read the record on cve.org

Description

<p>An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory. An attacker who exploited the vulnerability could use the information to compromise the user’s computer or data.</p> <p>To exploit the vulnerability, an attacker could craft a special document file and then convince the user to open it. An attacker must know the memory address location where the object was created.</p> <p>The update addresses the vulnerability by changing the way certain Excel functions handle objects in memory.</p>

Scores

CVSSScoreVectorSource
3.15.5 MediumCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N/E:P/RL:O/RC:Cmicrosoft

Weaknesses

The record names no weakness.

Affected Products

ProductVersions
Microsoft SharePoint Enterprise Server 2013 Service Pack 1Microsoft
  • 15.0.0 to before publicationAffected
Microsoft Office 2019Microsoft
  • 19.0.0 to before https://aka.ms/OfficeSecurityReleasesAffected
Microsoft Office 2019 for MacMicrosoft
  • 16.0.0 to before publicationAffected
Microsoft Office Online ServerMicrosoft
  • 16.0.1 to before publicationAffected
Microsoft 365 Apps for EnterpriseMicrosoft
  • 16.0.1 to before https://aka.ms/OfficeSecurityReleasesAffected
Microsoft Excel 2016Microsoft
  • 16.0.0.0 to before publicationAffected
Microsoft Office 2016 for MacMicrosoft
  • 16.0.0 to before publicationAffected
Microsoft Excel 2010 Service Pack 2Microsoft
  • 13.0.0.0 to before publicationAffected
Microsoft Excel 2013 Service Pack 1Microsoft
  • 15.0.0.0 to before publicationAffected
Microsoft Office Web Apps 2013 Service Pack 1Microsoft
  • 15.0.0.0 to before publicationAffected

References

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.