CVE-2020-1493
Microsoft Outlook Information Disclosure Vulnerability
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
1Exploited in Wild
-Decision
Descriptions
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users.
To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting.
The security update addresses the vulnerability by correcting how Outlook handles file attachment links.
Se presenta una vulnerabilidad de divulgación de información al adjuntar archivos a mensajes de Outlook, también se conoce como "Microsoft Outlook Information Disclosure Vulnerability".
This vulnerability allows remote attackers to execute arbitrary code on affected installations of Microsoft Outlook. User interaction is required to exploit this vulnerability in that the target must open a malicious email.
The specific flaw exists within the rendering of emails. The issue results from the lack of proper validation of user-supplied data, which can result in a read past the end of an allocated data structure. An attacker can leverage this vulnerability to execute code in the context of the current process.
CVSS Scores
SSVC
- Decision:Track*
Timeline
- 2019-11-04 CVE Reserved
- 2020-08-13 CVE Published
- 2020-08-25 First Exploit
- 2024-08-04 CVE Updated
- 2024-11-12 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
CWE
- CWE-922: Insecure Storage of Sensitive Information
CAPEC
References (3)
| URL | Tag | Source |
|---|---|---|
| http://packetstormsecurity.com/files/169960/Microsoft-Outlook-2019-16.0.12624.20424-Out-Of-Bounds-Read.html | Third Party Advisory |
|
| URL | Date | SRC |
|---|---|---|
| https://github.com/0neb1n/CVE-2020-1493 | 2020-08-25 |
| URL | Date | SRC |
|---|---|---|
| https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1493 | 2024-07-03 |
| URL | Date | SRC |
|---|
Affected Vendors, Products, and Versions
| Vendor | Product | Version | Other | Status | ||||||
|---|---|---|---|---|---|---|---|---|---|---|
| Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
| Microsoft Search vendor "Microsoft" | 365 Apps Search vendor "Microsoft" for product "365 Apps" | - | enterprise |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Office Search vendor "Microsoft" for product "Office" | 2019 Search vendor "Microsoft" for product "Office" and version "2019" | - |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2010 Search vendor "Microsoft" for product "Outlook" and version "2010" | sp2 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2013 Search vendor "Microsoft" for product "Outlook" and version "2013" | sp1 |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2013 Search vendor "Microsoft" for product "Outlook" and version "2013" | sp1, rt |
Affected
| ||||||
| Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | 2016 Search vendor "Microsoft" for product "Outlook" and version "2016" | - |
Affected
| ||||||