Vulnerability Description
An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who successfully exploited the vulnerability could attempt to force Outlook to load a local or remote message store (over SMB). To exploit the vulnerability, the attacker could send a specially crafted email to a victim. Outlook would then attempt to open a pre-configured message store contained in the email upon receipt of the email. This update addresses the vulnerability by ensuring Office fully validates incoming email formatting before processing message content.
CVSS Score
MEDIUM
Affected Products
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Office | 2019 |
| Microsoft | Office 365 Proplus | - |
| Microsoft | Outlook | 2010 |
Related Weaknesses (CWE)
References
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1204PatchVendor Advisory
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1204PatchVendor Advisory
FAQ
What is CVE-2019-1204?
CVE-2019-1204 is a vulnerability with a CVSS score of 4.3 (MEDIUM). An elevation of privilege vulnerability exists when Microsoft Outlook initiates processing of incoming messages without sufficient validation of the formatting of the messages. An attacker who success...
How severe is CVE-2019-1204?
CVE-2019-1204 has been rated MEDIUM with a CVSS base score of 4.3/10. Review the CVSS metrics above for detailed severity breakdown.
Is there a patch for CVE-2019-1204?
Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Office, Microsoft Office 365 Proplus, Microsoft Outlook.