cbcvebase.
CVE-2019-1204
published 2019-08-14

CVE-2019-1204: An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting…

PriorityP424medium4.3CVSS 3.0
AVNACLPRNUIRSUCLINAN
EPSS
4.42%
90.3th percentile
An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote message store (over SMB). To exploit the vulnerability, the attacker could send a specially crafted email to a victim. Outlook would then attempt to open a pre-configured message store contained in the email upon receipt of the email. This update addresses the vulnerability by ensuring Office fully validates incoming email formatting before processing message content.

Affected

17 ranges
VendorProductVersion rangeFixed in
microsoftmicrosoft_office_2019>= 19.0.0 < https://aka.ms/OfficeSecurityReleaseshttps://aka.ms/OfficeSecurityReleases
microsoftmicrosoft_outlook_2010_service_pack_2>= 13.0.0.0 < publicationpublication
microsoftmicrosoft_outlook_2013_service_pack_1>= 15.0.0.0 < publicationpublication
microsoftmicrosoft_outlook_2016>= 16.0.0.0 < publicationpublication
microsoftoffice
microsoftoffice_365_proplus>= 16.0.0 < publicationpublication
microsoftoutlook
microsoftoutlook
microsoftoutlook
msrcmicrosoft_office_2019_for_32-bit_editions
msrcmicrosoft_office_2019_for_64-bit_editions
msrcmicrosoft_outlook_2010_service_pack_2
msrcmicrosoft_outlook_2013_rt_service_pack_1
msrcmicrosoft_outlook_2013_service_pack_1
msrcmicrosoft_outlook_2016
msrcoffice_365_proplus_for_32-bit_systems
msrcoffice_365_proplus_for_64-bit_systems

CVSS provenance

nvdv3.04.3MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vendor_redhat5.4MEDIUM
vendor_msrc4.3HIGH
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.