CVE-2019-1264 - Vulnerability Details - OpenCVE

A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'.

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is not in the KEV list.

The EPSS score is 0.07973.

Key SSVC decision points have not yet been added.

Vendors	Products
Microsoft	Office Office 365 Proplus Project

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:office:2010:sp2::::::
	cpe:2.3:a:microsoft:office:2013:sp1::::::
	cpe:2.3:a:microsoft:office:2013:sp1:::rt:::*
	cpe:2.3:a:microsoft:office:2016:::::::*
	cpe:2.3:a:microsoft:office:2019:::::::*
	cpe:2.3:a:microsoft:office_365_proplus:-:::::::*
	cpe:2.3:a:microsoft:project:2010:sp2::::::
	cpe:2.3:a:microsoft:project:2013:sp1::::::
	cpe:2.3:a:microsoft:project:2016:::::::*

No data.

No data.

Advisories

Source	ID	Title
EUVD	EUVD-2019-9829	A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'.

Fixes

Solution

No solution given by the vendor.

Workaround

No workaround given by the vendor.

References

Link	Providers
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264

History

No history.

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2019-09-11T21:24:59

Updated: 2024-08-04T18:13:29.543Z

Reserved: 2018-11-26T00:00:00

Link: CVE-2019-1264

Vulnrichment

No data.

NVD

Status : Modified

Published: 2019-09-11T22:15:16.897

Modified: 2024-11-21T04:36:21.857

Link: CVE-2019-1264

Redhat

No data.

OpenCVE Enrichment

No data.

{"containers": {"cna": {"affected": [{"product": "Microsoft Project", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "2010 Service Pack 2 (32-bit editions)"}, {"status": "affected", "version": "2010 Service Pack 2 (64-bit editions)"}, {"status": "affected", "version": "2016 (32-bit edition)"}, {"status": "affected", "version": "2016 (64-bit edition)"}, {"status": "affected", "version": "2013 Service Pack 1 (32-bit editions)"}, {"status": "affected", "version": "2013 Service Pack 1 (64-bit editions)"}]}, {"product": "Microsoft Office", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "2010 Service Pack 2 (32-bit editions)"}, {"status": "affected", "version": "2010 Service Pack 2 (64-bit editions)"}, {"status": "affected", "version": "2013 Service Pack 1 (32-bit editions)"}, {"status": "affected", "version": "2013 Service Pack 1 (64-bit editions)"}, {"status": "affected", "version": "2013 RT Service Pack 1"}, {"status": "affected", "version": "2016 (32-bit edition)"}, {"status": "affected", "version": "2016 (64-bit edition)"}, {"status": "affected", "version": "2019 for 32-bit editions"}, {"status": "affected", "version": "2019 for 64-bit editions"}]}, {"product": "Office 365 ProPlus", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "32-bit Systems"}, {"status": "affected", "version": "64-bit Systems"}]}], "descriptions": [{"lang": "en", "value": "A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'."}], "problemTypes": [{"descriptions": [{"description": "Security Feature Bypass", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-09-11T21:24:59", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"tags": ["x_refsource_MISC"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2019-1264", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Microsoft Project", "version": {"version_data": [{"version_value": "2010 Service Pack 2 (32-bit editions)"}, {"version_value": "2010 Service Pack 2 (64-bit editions)"}, {"version_value": "2016 (32-bit edition)"}, {"version_value": "2016 (64-bit edition)"}, {"version_value": "2013 Service Pack 1 (32-bit editions)"}, {"version_value": "2013 Service Pack 1 (64-bit editions)"}]}}, {"product_name": "Microsoft Office", "version": {"version_data": [{"version_value": "2010 Service Pack 2 (32-bit editions)"}, {"version_value": "2010 Service Pack 2 (64-bit editions)"}, {"version_value": "2013 Service Pack 1 (32-bit editions)"}, {"version_value": "2013 Service Pack 1 (64-bit editions)"}, {"version_value": "2013 RT Service Pack 1"}, {"version_value": "2016 (32-bit edition)"}, {"version_value": "2016 (64-bit edition)"}, {"version_value": "2019 for 32-bit editions"}, {"version_value": "2019 for 64-bit editions"}]}}, {"product_name": "Office 365 ProPlus", "version": {"version_data": [{"version_value": "32-bit Systems"}, {"version_value": "64-bit Systems"}]}}]}, "vendor_name": "Microsoft"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Security Feature Bypass"}]}]}, "references": {"reference_data": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264", "refsource": "MISC", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-04T18:13:29.543Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264"}]}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2019-1264", "datePublished": "2019-09-11T21:24:59", "dateReserved": "2018-11-26T00:00:00", "dateUpdated": "2024-08-04T18:13:29.543Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*", "matchCriteriaId": "081DE1E3-4622-4C32-8B9C-9AEC1CD20638", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*", "matchCriteriaId": "120690A6-E0A1-4E36-A35A-C87109ECC064", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*", "matchCriteriaId": "F7DDFFB8-2337-4DD7-8120-56CC8EF134B4", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*", "matchCriteriaId": "E0B3B0BC-C7C6-4687-AD72-DCA29FF9AE3A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*", "matchCriteriaId": "FF177984-A906-43FA-BF60-298133FBBD6B", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*", "matchCriteriaId": "CA035812-F35A-43F1-9A8D-EE02201AA10A", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:project:2010:sp2:*:*:*:*:*:*", "matchCriteriaId": "39EA4DCC-AA3F-4E3B-8754-BF79B2FD8657", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:project:2013:sp1:*:*:*:*:*:*", "matchCriteriaId": "33E26FF2-B80D-4C64-B9D5-ED0DE4BF3B1F", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:project:2016:*:*:*:*:*:*:*", "matchCriteriaId": "5AA3A3C2-DB00-4095-B445-5A5041EB3194", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "descriptions": [{"lang": "en", "value": "A security feature bypass vulnerability exists when Microsoft Office improperly handles input, aka 'Microsoft Office Security Feature Bypass Vulnerability'."}, {"lang": "es", "value": "Se presenta una vulnerabilidad de omisi\u00f3n de la caracter\u00edstica de seguridad cuando Microsoft Office maneja inapropiadamente la entrada, tambi\u00e9n se conoce como \"Microsoft Office Security Feature Bypass Vulnerability\"."}], "id": "CVE-2019-1264", "lastModified": "2024-11-21T04:36:21.857", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}]}, "published": "2019-09-11T22:15:16.897", "references": [{"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1264"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Modified", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}]}