Microsoft Excel Security Feature Bypass Vulnerability
CVE-2021-42292

7.8HIGH

Key Information:

Vendor
Microsoft
Status
Microsoft Office 2019
Microsoft Office 2019 For Mac
Microsoft 365 Apps For Enterprise
Microsoft Office Ltsc For Mac 2021
Vendor
CVE Published:
10 November 2021

Badges

👾 Exploit Exists🟡 Public PoC🟣 EPSS 25%🦅 CISA Reported

Summary

Microsoft Excel Security Feature Bypass Vulnerability

CISA Reported

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed as being exploited but is not known by the CISA to be used in ransomware campaigns. This is subject to change at pace

The CISA's recommendation is: Apply updates per vendor instructions.

Affected Version(s)

Microsoft 365 Apps for Enterprise 32-bit Systems 16.0.1

Microsoft Excel 2013 Service Pack 1 ARM64-based Systems 15.0.0.0 < 15.0.5397.1001

Microsoft Excel 2016 32-bit Systems 16.0.0.0 < 16.0.5239.1001

Exploit Proof of Concept (PoC)

PoC code is written by security researchers to demonstrate the vulnerability can be exploited. PoC code is also a key component for weaponization which could lead to ransomware.

CVE-2021-42292
Created by corelight

References

https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_MISC

EPSS Score

25% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 🦅

    CISA Reported

  • Vulnerability published

  • 🟡

    Public PoC available

  • 👾

    Exploit known to exist

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre DatabaseCISA Database1 Proof of Concept(s)
.