CVE-2018-8558High

Microsoft Outlook Information Disclosure Vulnerability

Published
November 13, 2018
Last Modified
—

🔗 CVE IDs covered (1)

CVE-2018-8558 →

📋 Description

An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin Center. A malicious user could potentially share anonymously-accessible links to other users via email where these links are intended to be accessed only by specific users. The security update addresses the vulnerability by correcting how Microsoft Outlook generates links inserted into emails via the "Attach File" interface.

🎯 Affected products4

  • Microsoft Office 2019 for 32-bit editions
  • Microsoft Office 2019 for 64-bit editions
  • Office 365 ProPlus for 32-bit Systems
  • Office 365 ProPlus for 64-bit Systems

✅ Remediation

KBClick to Run (Security Update) — fixed build https://aka.ms/OfficeSecurityReleases KBClick to Run (Security Update)

🔗 References (1)