CVE-2020-1449: 
vulnerability analysis and mitigation

A remote code execution vulnerability (CVE-2020-1449) was identified in Microsoft Project software, discovered and disclosed in July 2020. The vulnerability exists when the software fails to properly check the source markup of a file. This vulnerability affects multiple versions of Microsoft products including Microsoft 365 Apps, Office 2010 SP2, Office 2013 SP1, Office 2019, and Project 2016 in both x64 and x86 architectures (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (High) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it received a base score of 9.3 (High) with the vector string (AV:N/AC:M/Au:N/C:C/I:C/A:C). The vulnerability is classified as CWE-346 (Origin Validation Error) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. The vulnerability affects the confidentiality, integrity, and availability of the system, with all three aspects rated as 'High' in the CVSS scoring (Rapid7).

The vulnerability requires user interaction for successful exploitation, as indicated by the CVSS metrics. The attack complexity is considered low, but requires the victim to voluntarily interact with the attack mechanism (NVD).

Microsoft has released security updates to address this vulnerability. Users are advised to apply the appropriate patches through Microsoft's security update channels, including KB4484441 for Microsoft Project 2016 (Rapid7).