Rapid7 Vulnerability & Exploit Database

Microsoft CVE-2020-0647: Microsoft Office Online Spoofing Vulnerability

Back to Search

Microsoft CVE-2020-0647: Microsoft Office Online Spoofing Vulnerability

Severity
6
CVSS
(AV:N/AC:M/Au:N/C:P/I:P/A:N)
Published
01/14/2020
Created
01/15/2020
Added
01/14/2020
Modified
01/23/2020

Description

A spoofing vulnerability exists when Office Online does not validate origin in cross-origin communications correctly. An attacker could exploit the vulnerability by sending a specially crafted request to an affected site. The attacker who successfully exploited the vulnerability could then perform cross-origin attacks on affected systems. These attacks could allow the attacker to read content that the attacker is not authorized to read, and use the victim's identity to take actions on the site on behalf of the victim. The victim needs to be authenticated for an attacker to compromise the victim. The security update addresses the vulnerability by ensuring that Office Online properly validates origins.

Solution(s)

  • msft-kb4484223-422c7f39-675b-420f-b1ae-82ec1d848d81

With Rapid7 live dashboards, I have a clear view of all the assets on my network, which ones can be exploited, and what I need to do in order to reduce the risk in my environment in real-time. No other tool gives us that kind of value and insight.

– Scott Cheney, Manager of Information Security, Sierra View Medical Center

;