CVE-2019-0540
published 2019-03-05CVE-2019-0540: A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which…
PriorityP432medium5.5CVSS 3.0
AVLACLPRNUIRSUCNIHAN
EPSS
12.78%
95.8th percentile
A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.
Affected
31 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_excel_viewer | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office_compatibility_pack | — | — |
| microsoft | microsoft_powerpoint_viewer | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office | — | — |
| microsoft | office_365_proplus | — | — |
| microsoft | office_365_proplus | — | — |
| msrc | microsoft_excel_viewer | — | — |
| msrc | microsoft_office_2010_service_pack_2 | — | — |
| msrc | microsoft_office_2013_rt_service_pack_1 | — | — |
| msrc | microsoft_office_2013_service_pack_1 | — | — |
| msrc | microsoft_office_2016 | — | — |
| msrc | microsoft_office_2019_for_32-bit_editions | — | — |
CVSS provenance
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_msrc5.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Office Security Feature Bypass Vulnerability
vendor_msrc·2019-02-12·CVSS 5.5
CVE-2019-0540 [MEDIUM] Microsoft Office Security Feature Bypass Vulnerability
Microsoft Office Security Feature Bypass Vulnerability
Description: A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.
An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials. An attacker who successfully exploited this vulnerability could perform a phishing attack.
The update addresses the vulnerability by ensuring Microsoft Office properly validates URLs.
FAQ: Does the behavior change after applying this update?
This update causes a change in behavior for documents that have an IncludePicture field with delayed loading for online pictures that are hosted on un-trusted sites that require authentication to load the picture.
Before applying the update, a dialog would be displayed requesting
GHSA
GHSA-64wm-87jc-34mv: A security feature bypass vulnerability exists when Microsoft Office does not validate URLs
ghsa_unreviewed·2022-05-13
CVE-2019-0540 [MEDIUM] CWE-601 GHSA-64wm-87jc-34mv: A security feature bypass vulnerability exists when Microsoft Office does not validate URLs
A security feature bypass vulnerability exists when Microsoft Office does not validate URLs.An attacker could send a victim a specially crafted file, which could trick the victim into entering credentials, aka 'Microsoft Office Security Feature Bypass Vulnerability'.
No detection rules found.
No public exploits indexed.
No writeups or analysis indexed.
2019-03-05
Published