CVE-2020-17122: 
vulnerability analysis and mitigation

CVE-2020-17122 is a Microsoft Excel Remote Code Execution Vulnerability that affects Microsoft Office 2010 Service Pack 2 and SharePoint Server 2010 Office Web Apps. The vulnerability was disclosed and patched by Microsoft in December 2020 (Microsoft Advisory).

The vulnerability has been assigned a CVSS 3.1 Base Score of 7.8 (High) with the following vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS 2.0, it received a Base Score of 9.3 (High) with vector (AV:N/AC:M/Au:N/C:C/I:C/A:C) (NVD).

If successfully exploited, this vulnerability could allow an attacker to execute arbitrary code in the context of the current user. If the current user has administrative privileges, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights (Microsoft Advisory).

Microsoft has released security updates to address this vulnerability. Users should install security update 4486704 for the 64-bit version of SharePoint Server 2010 Office Web Apps, or security update 4486698 for both 32-bit and 64-bit versions of Office 2010. The updates are available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center (Microsoft Support).