Microsoft Excel Information Disclosure Vulnerability

The Microsoft Excel Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17123,     CVE-2020-17125, CVE-2020-17127, CVE-2020-17128,     CVE-2020-17129)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17126)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2020-17130)

The Microsoft Office product installed on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - Microsoft Excel Remote Code Execution Vulnerability (CVE-2020-17123, CVE-2020-17128)

  - Microsoft Excel Information Disclosure Vulnerability (CVE-2020-17126)

  - Microsoft Outlook Information Disclosure Vulnerability (CVE-2020-17119)

  - Microsoft PowerPoint Remote Code Execution Vulnerability (CVE-2020-17124)

Note that Nessus has not tested for this issue but has instead relied only on the application's self-reported version number.

The Microsoft Office Online Server or Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17122,     CVE-2020-17123, CVE-2020-17125, CVE-2020-17128,     CVE-2020-17129)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17126)

ID	Name	Product	Family	Severity
162119	Security Updates for Microsoft Excel Products C2R (December 2020)	Nessus	Windows	high
145269	Security Updates for Microsoft Office (December 2020) (macOS)	Nessus	MacOS X Local Security Checks	high
143564	Security Updates for Microsoft Excel Products (December 2020)	Nessus	Windows : Microsoft Bulletins	high
143556	Security Updates for Microsoft Office Online Server and Microsoft Office Web Apps (December 2020)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2020-17126

medium

Tenable Plugins

high

high

high

high