CVE-2020-17067: 
vulnerability analysis and mitigation

Microsoft Excel Security Feature Bypass Vulnerability (CVE-2020-17067) was disclosed on November 10, 2020. This vulnerability affects multiple versions of Microsoft Excel and Microsoft Office products, including Excel 2010, Excel 2013, Excel 2016, Microsoft 365 Apps, and Office 2019 (NVD).

The vulnerability has been assigned a CVSS v3.1 base score of 7.8 (HIGH) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. The CVSS v2.0 base score is 6.8 (MEDIUM) with vector (AV:N/AC:M/Au:N/C:P/I:P/A:P) (NVD).

If successfully exploited, this security feature bypass vulnerability could allow an attacker to bypass security features in Microsoft Excel, potentially leading to unauthorized access with high impacts on confidentiality, integrity, and availability of the affected system (NVD).

The vulnerability requires user interaction and local access for exploitation, as indicated by the CVSS vector components UI:R (User Interaction Required) and AV:L (Local Access) (NVD).

Microsoft has released security updates to address this vulnerability. Users should apply the security update KB4486743 for Excel 2010 and corresponding updates for other affected versions. The updates are available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center (Microsoft Support).