CVE-2020-1493: Microsoft Outlook Information Disclosure Vulnerability
CVE-2020-1493 is an information disclosure vulnerability in Microsoft Outlook, rated Important by Microsoft. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 7.30% probability of exploitation activity in the next 30 days, higher than 94% of all scored vulnerabilities. Microsoft released the fix on 11 August 2020 in the August 2020 Patch Tuesday, delivered through 3 security updates (KB4484475, KB4484486, KB4484497). It affects 11 products in 1 product family (Microsoft Office).
Key facts
- CVE ID
- CVE-2020-1493
- Severity
- N/A
- Microsoft severity
- Important
- Impact
- Information Disclosure
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-922
- EPSS
- 7.30% (percentile 94%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- August 2020 Patch Tuesday
- Product families
- Microsoft Office
Description
An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users.
To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting.
The security update addresses the vulnerability by correcting how Outlook handles file attachment links.
Frequently asked questions (Microsoft)
What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vulnerability is uninitialized memory.
Is the Preview Pane an attack vector for this vulnerability?
Yes, the Preview Pane is an attack vector.
If the preview pane is an attack vector, why is the severity for this vulnerability Important and not Critical?
Even though the preview pane is an attack vector, the attacker cannot achieve remote code execution if they successfully exploit the vulnerability, but can only gain information from the victim.
Affected products (11)
Microsoft Office
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Office 2019 for 32-bit editions | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Microsoft Office 2019 for 64-bit editions | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Microsoft 365 Apps for Enterprise for 32-bit Systems | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Microsoft 365 Apps for Enterprise for 64-bit Systems | Click to Run | Security Update | https://aka.ms/OfficeSecurityReleases | No |
| Microsoft Outlook 2016 (32-bit edition) | KB4484475 | Security Update | Maybe | |
| Microsoft Outlook 2016 (64-bit edition) | KB4484475 | Security Update | Maybe | |
| Microsoft Outlook 2013 Service Pack 1 (32-bit editions) | KB4484486 | Security Update | Maybe | |
| Microsoft Outlook 2013 Service Pack 1 (64-bit editions) | KB4484486 | Security Update | Maybe | |
| Microsoft Outlook 2010 Service Pack 2 (32-bit editions) | KB4484497 | Security Update | Maybe | |
| Microsoft Outlook 2010 Service Pack 2 (64-bit editions) | KB4484497 | Security Update | Maybe | |
| Microsoft Outlook 2013 RT Service Pack 1 | KB4484486 | Security Update | Maybe |
Security updates (3)
Exploitation and detection
Detection and weaponization
Weaponization maturity: Exploit.
Proof-of-concept repositories (1)
- 0neb1n/CVE-2020-1493 · 25 stars
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 5.5 (MEDIUM)
- NVD weakness
- CWE-922
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| 365 apps | all listed versions |
| office 2019 | all listed versions |
| outlook 2010 | all listed versions |
| outlook 2013 | all listed versions |
| outlook 2013 | all listed versions |
| outlook 2016 | all listed versions |
References
- http://packetstormsecurity.com/files/169960/Microsoft-Outlook-2019-16.0.12624.20424-Out-Of-Bounds-Read.html (Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1493 (Patch, Vendor Advisory)
- http://packetstormsecurity.com/files/169960/Microsoft-Outlook-2019-16.0.12624.20424-Out-Of-Bounds-Read.html (Third Party Advisory, VDB Entry)
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1493 (Patch, Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |