CVE-2019-1109: microsoft microsoft office Improper Input Validation
Vulnerability summary
CVE-2019-1109 is a critical (CVSS 9.1) Improper Input Validation vulnerability in microsoft microsoft office. EPSS estimates a 4.24% chance of exploitation in the next 30 days, higher than 90.9% of scored vulnerabilities.
Timeline
- 29-07-2019PublishedVulnerability first disclosed.
- 04-08-2024Last modifiedVulnerability information updated.
Description
A spoofing vulnerability exists when Microsoft Office Javascript does not check the validity of the web page making a request to Office documents.An attacker who successfully exploited this vulnerability could read or write information in Office documents.The security update addresses the vulnerability by correcting the way that Microsoft Office Javascript verifies trusted web pages., aka 'Microsoft Office Spoofing Vulnerability'.
CVSS metrics
2 scores · 1 source · 2 versionsEPSS trend
Probability
4.24%
Chance of exploitation in the next 30 days
Percentile
91%
Versus all other CVEs
30-day change
0.00 pp
From 4.24% on 19-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
0 foundNo public exploits indexed.
Weaknesses
CWE · root causeAffected systems
Microsoft4 products
- microsoft office2013 Service Pack 1 (32-bit editions) | 2013 Service Pack 1 (64-bit editions) | 2013 RT Service Pack 1 | 2016 (32-bit edition) | 2016 (64-bit edition) | 2019 for 32-bit editions | 2019 for 64-bit editions
- officeEOL2013:sp1 | 2016 | 2019
- office_365na
- office_365_proplus32-bit Systems | 64-bit Systems
1 vendor · 4 products
References
1 links
portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-1109X Refsource MISCPatchVendor Advisory