Microsoft Excel Security Feature Bypass Vulnerability

The Microsoft Excel Products are missing security updates.
It is, therefore, affected by multiple vulnerabilities:

  - A security feature bypass vulnerability exists. An     attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising     the integrity of the system/application.
    (CVE-2021-42292)

  - A remote code execution vulnerability. An attacker can     exploit this to bypass authentication and execute     unauthorized arbitrary commands. (CVE-2021-40442)

The Microsoft Office product installed on the remote host is affected by multiple vulnerabilities, as follows:

  - A remote code execution vulnerability in Excel that can be exploited by an unauthenticated, local     attacker. (CVE-2021-40442)

  - A security feature bypass vulnerability in Excel that can be exploited by an unauthenticated, local     attacker. (CVE-2021-42292)

  Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version number.

The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities:

  - A security feature bypass vulnerability exists. An attacker can exploit this and bypass the security     feature and perform unauthorized actions compromising the integrity of the system/application.
    (CVE-2021-42292)

  - Two remote code execution vulnerabilities. An attacker can exploit this to bypass authentication and     execute unauthorized arbitrary commands. (CVE-2021-40442, CVE-2021-41368)

ID	Name	Product	Family	Type	Severity
161757	Security Updates for Microsoft Excel Products C2R (November 2021)	Nessus	Windows	Local	high
155448	Security Updates for Microsoft Office (November 2021) (macOS)	Nessus	MacOS X Local Security Checks	Local	high
155000	Security Updates for Microsoft Office Products (November 2021)	Nessus	Windows : Microsoft Bulletins	Local	high
154982	Security Updates for Microsoft Excel Products (November 2021)	Nessus	Windows : Microsoft Bulletins	Local	high

Detections

Analytics

CVE-2021-42292

high

Tenable Plugins

high

high

high

high