Microsoft Excel Remote Code Execution Vulnerability

The Microsoft Excel Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities:

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17123,     CVE-2020-17125, CVE-2020-17127, CVE-2020-17128,     CVE-2020-17129)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17126)

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2020-17130)

The Microsoft Office Online Server or Microsoft Office Web Apps installation on the remote host is missing security updates. It is, therefore, affected by multiple vulnerabilities :

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2020-17122,     CVE-2020-17123, CVE-2020-17125, CVE-2020-17128,     CVE-2020-17129)

  - An information disclosure vulnerability. An attacker can     exploit this to disclose potentially sensitive     information. (CVE-2020-17126)

ID	Name	Product	Family	Severity
162119	Security Updates for Microsoft Excel Products C2R (December 2020)	Nessus	Windows	high
143564	Security Updates for Microsoft Excel Products (December 2020)	Nessus	Windows : Microsoft Bulletins	high
143556	Security Updates for Microsoft Office Online Server and Microsoft Office Web Apps (December 2020)	Nessus	Windows : Microsoft Bulletins	high

Detections

Analytics

CVE-2020-17129

high

Tenable Plugins

high

high

high