Strix
26.1K

CVE-2020-16934

HIGHCVSS 7/10EPSS 2.48%

Last modified

CVE-2020-16934 is a high-severity vulnerability rated 7/10 on the CVSS scale. <p>An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) AppVLP handles certain files. An attacker who successfully exploited the vulnerability could elevate privileges.</p> <p>To exploit this vulnerability, an attacker would need to convince a user to open a specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Office Click-to-Run (C2R) components handle these files.</p>. EPSS estimates a 2.48% chance of exploitation in the next 30 days.

Description

<p>An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) AppVLP handles certain files. An attacker who successfully exploited the vulnerability could elevate privileges.</p> <p>To exploit this vulnerability, an attacker would need to convince a user to open a specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Office Click-to-Run (C2R) components handle these files.</p>

Metrics

CVSS 3.1
7/10

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

EPSS Probability
2.48%

82.5th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
Microsoft365 AppsAll versions
MicrosoftOffice2019
MicrosoftOffice 2013 Click-To-RunAll versions

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2020-16934?
<p>An elevation of privilege vulnerability exists in the way that Microsoft Office Click-to-Run (C2R) AppVLP handles certain files. An attacker who successfully exploited the vulnerability could elevate privileges.</p> <p>To exploit this vulnerability, an attacker would need to convince a user to open a specially crafted file.</p> <p>The security update addresses the vulnerability by correcting how Microsoft Office Click-to-Run (C2R) components handle these files.</p>
How severe is CVE-2020-16934?
CVE-2020-16934 has a CVSS score of 7/10 (HIGH severity). The EPSS model estimates a 2.48% probability of exploitation in the next 30 days.
How do I fix CVE-2020-16934?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2020-16934?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST