« Volver al listado

CVE-2020-1449

Estado: ModificadaAlta (7.8)—

A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project Remote Code Execution Vulnerability'.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (3)

Microsoft — 365 AppsMicrosoft — OfficeMicrosoft — Project 2016

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2020-1449",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office",
          "versions": [
            {
              "status": "affected",
              "version": "2019 for 32-bit editions"
            },
            {
              "status": "affected",
              "version": "2019 for 64-bit editions"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft 365 Apps for Enterprise for 32-bit Systems",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft 365 Apps for Enterprise for 64-bit Systems",
          "versions": [
            {
              "status": "affected",
              "version": "unspecified"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Microsoft Project",
          "versions": [
            {
              "status": "affected",
              "version": "2013 Service Pack 1 (32-bit editions)"
            },
            {
              "status": "affected",
              "version": "2013 Service Pack 1 (64-bit editions)"
            },
            {
              "status": "affected",
              "version": "2016 (32-bit edition)"
            },
            {
              "status": "affected",
              "version": "2016 (64-bit edition)"
            },
            {
              "status": "affected",
              "version": "2010 Service Pack 2 (32-bit editions)"
            },
            {
              "status": "affected",
              "version": "2010 Service Pack 2 (64-bit editions)"
            }
          ]
        }
      ]
    }
  ],
  "published": "2020-07-14T23:15:20.090",
  "references": [
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1449",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1449",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-346"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists in Microsoft Project software when the software fails to check the source markup of a file, aka 'Microsoft Project Remote Code Execution Vulnerability'."
    },
    {
      "lang": "es",
      "value": "Se presenta una vulnerabilidad de ejecución de código remota en el software Microsoft Project cuando el software presenta un fallo al comprobar el marcado de origen de un archivo, también se conoce como \"Microsoft Project Remote Code Execution Vulnerability\""
    }
  ],
  "lastModified": "2026-06-17T03:01:26.110",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "3259EBFE-AE2D-48B8-BE9A-E22BBDB31378"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "CD25F492-9272-4836-832C-8439EBE64CCF"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "BB0CF266-A7EE-474A-B3D3-4A7FE33F4C2C"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "DC25ACD6-8F48-4534-AF7B-53F0D10C0843"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "24DD7E07-4BB1-4914-9CDE-5A27A9A3920E"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "ADA0E394-3B5E-4C34-955B-EAB645A37518"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:*",
              "vulnerable": true,
              "matchCriteriaId": "C5282C83-86B8-442D-851D-B54E88E8B1F1"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project_2016:-:*:*:*:*:*:x64:*",
              "vulnerable": true,
              "matchCriteriaId": "B12CB472-844C-40F8-8228-AF9C4BC276B3"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:project_2016:-:*:*:*:*:*:x86:*",
              "vulnerable": true,
              "matchCriteriaId": "ADE92B03-48F5-43A0-A40F-EF36B4C6CA6B"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}