CVE-2020-17128 : Security Advisory and Response
Learn about CVE-2020-17128, a Remote Code Execution vulnerability in Microsoft Excel with a high impact. Find out affected systems, exploitation details, and mitigation steps.
Microsoft Excel Remote Code Execution Vulnerability was published on December 9, 2020, with a CVSS base score of 7.8.
Understanding CVE-2020-17128
This CVE involves a Remote Code Execution vulnerability in Microsoft Excel.
What is CVE-2020-17128?
The CVE-2020-17128 is a security vulnerability that allows remote attackers to execute arbitrary code on the target system through a specially crafted Excel file.
The Impact of CVE-2020-17128
The impact of this vulnerability is rated as HIGH, with a CVSS base score of 7.8. Attackers can exploit this flaw to take control of affected systems, leading to potential data breaches, system compromise, and unauthorized access.
Technical Details of CVE-2020-17128
This section provides more technical insights into the CVE.
Vulnerability Description
The vulnerability allows remote code execution in Microsoft Excel, enabling attackers to run malicious code on the target system.
Affected Systems and Versions
- Microsoft Office 2019 (Version 19.0.0)
- Microsoft Office 2019 for Mac (Version 16.0.0)
- Microsoft Office Online Server (Version 16.0.1)
- Microsoft 365 Apps for Enterprise (Version 16.0.1)
- Microsoft Excel 2016 (Version 16.0.0.0)
- Microsoft Office 2016 (Version 16.0.0)
- Microsoft Excel 2010 Service Pack 2 (Version 13.0.0.0)
- Microsoft Excel 2013 Service Pack 1 (Version 15.0.0.0)
- Microsoft Office 2010 Service Pack 2 (Version 13.0.0.0)
- Microsoft Office Web Apps 2013 Service Pack 1 (Version 15.0.0.0)
Exploitation Mechanism
The vulnerability can be exploited by enticing a user to open a specially crafted Excel file, triggering the execution of malicious code.
Mitigation and Prevention
Protect your systems from CVE-2020-17128 with the following measures.
Immediate Steps to Take
- Apply security patches provided by Microsoft.
- Educate users about the risks of opening unsolicited Excel files.
- Implement email filtering to block suspicious attachments.
Long-Term Security Practices
- Regularly update Microsoft Office and Excel to the latest versions.
- Conduct security awareness training to enhance user vigilance.
Patching and Updates
Ensure timely installation of security updates and patches released by Microsoft to address the CVE-2020-17128 vulnerability.