TI-2020-01452 Aliases CVE-2020-1493 GHSA-w39r-2vjm-hgjq

Microsoft Outlook Information Disclosure Vulnerability

MEDIUM 58CWE-922Published 2020-08-17 · Updated 2024-08-04

Key facts

Attack vector: Local
Privileges required: None
User interaction: Required
Attack complexity: Low
Impact type: Information disclosure
Confidentiality · integrity · availability: High · None · None
Fix status: Fixed

Attack profile from CVSS 3.1 · CISA ADP. Fix status from CNA. Impact type from CWE-922.

Summary

An information disclosure vulnerability exists when attaching files to Outlook messages. This vulnerability could potentially allow users to share attached files such that they are accessible by anonymous users where they should be restricted to specific users. To exploit this vulnerability, an attacker would have to attach a file as a link to an email. The email could then be shared with individuals that should not have access to the files, ignoring the default organizational setting. The security update addresses the vulnerability by correcting how Outlook handles file attachment links.

Why it matters now

Exploitation Proof of concept CISA SSVC · not in CISA KEV

EPSS 0.07296 94th percentileScored 2026-11-07

Fix Fixed Microsoft Office 2019 (Microsoft): https://aka.ms/OfficeSecurityReleasesMicrosoft 365 Apps for Enterprise (Microsoft): https://aka.ms/OfficeSecurityReleases+3 more products

SSVC decision points

CISA ADP · SSVC 2.0.3

Exploitation: Poc
Automatable: No
Technical impact: Partial

The decision (Track, Attend, Act) also depends on your mission and well-being impact; see CISA's SSVC guide.

Affected products

Vendor	Product	Affected versions	Fixed in	Status	Source
Microsoft	Microsoft Office 2019	19.0.0 to before https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases	Patch available	CNA
Microsoft	Microsoft 365 Apps for Enterprise	16.0.1 to before https://aka.ms/OfficeSecurityReleases	https://aka.ms/OfficeSecurityReleases	Patch available	CNA
Microsoft	Microsoft Outlook 2016	16.0.0.0 to before publication	publication	Patch available	CNA
Microsoft	Microsoft Outlook 2013 Service Pack 1	15.0.0.0 to before publication	publication	Patch available	CNA
Microsoft	Microsoft Outlook 2010 Service Pack 2	13.0.0.0 to before publication	publication	Patch available	CNA

Microsoft Office 2019 VendorMicrosoft Affected 19.0.0 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
Microsoft 365 Apps for Enterprise VendorMicrosoft Affected 16.0.1 to before https://aka.ms/OfficeSecurityReleases Fixed in https://aka.ms/OfficeSecurityReleases Patch available CNA
Microsoft Outlook 2016 VendorMicrosoft Affected 16.0.0.0 to before publication Fixed in publication Patch available CNA
Microsoft Outlook 2013 Service Pack 1 VendorMicrosoft Affected 15.0.0.0 to before publication Fixed in publication Patch available CNA
Microsoft Outlook 2010 Service Pack 2 VendorMicrosoft Affected 13.0.0.0 to before publication Fixed in publication Patch available CNA

CPE configurations NVD · 6

CPE	Versions	Role	Vendor
cpe:2.3:a:microsoft:365_apps:-::::enterprise:::	not specified by NVD	Vulnerable	Microsoft
cpe:2.3:a:microsoft:office:2019:::::-::	2019	Vulnerable	Microsoft
cpe:2.3:a:microsoft:outlook:2010:sp2::::::	2010 sp2	Vulnerable	Microsoft
cpe:2.3:a:microsoft:outlook:2013:sp1::::::	2013 sp1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:outlook:2013:sp1:::rt:::*	2013 sp1	Vulnerable	Microsoft
cpe:2.3:a:microsoft:outlook:2016:::::::*	2016	Vulnerable	Microsoft

cpe:2.3:a:microsoft:365_apps:-:*:*:*:enterprise:*:*:* Versions not specified by NVD Vulnerable ·Microsoft
cpe:2.3:a:microsoft:office:2019:*:*:*:*:-:*:* Versions 2019 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:* Versions 2010 sp2 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft

Remediation

Fix · CNA Microsoft Office 2019 (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
Fix · CNA Microsoft 365 Apps for Enterprise (Microsoft) Fixed in https://aka.ms/OfficeSecurityReleases
Fix · CNA Microsoft Outlook 2016 (Microsoft) Fixed in publication
Fix · CNA Microsoft Outlook 2013 Service Pack 1 (Microsoft) Fixed in publication
Fix · CNA Microsoft Outlook 2010 Service Pack 2 (Microsoft) Fixed in publication

Timeline

2026-10-02 Threatist record created from CVE-2020-1493
2026-10-03 Alias added: GHSA-w39r-2vjm-hgjq

References

Patch 1

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-1493

Advisory 1

http://packetstormsecurity.com/files/169960/Microsoft-Outlook-2019-16.0.12624.20424-Out-Of-Bounds-Read.html

TI-2024-14173 Microsoft Outlook Remote Code Execution Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2023-09240 Microsoft Outlook Elevation of Privilege Vulnerability KEVCVSS 3.1CRITICAL 9.8
TI-2024-25471 Microsoft Project Remote Code Execution Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2023-17652 Microsoft Outlook Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 8.8
TI-2026-17368 Microsoft Word Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8
TI-2026-17363 Microsoft Office Security Feature Bypass Vulnerability KEVCVSS 3.1HIGH 7.8

See all 935 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences