CVE-2020-17123: 
vulnerability analysis and mitigation

Microsoft Excel Remote Code Execution Vulnerability (CVE-2020-17123) was identified and disclosed in December 2020. This vulnerability affects various versions of Microsoft Excel, including Excel 2010 SP2, Excel 2013 SP1, Excel 2016, Excel 2019, Microsoft 365 Apps Enterprise, and Office Online Server (NVD).

The vulnerability received a CVSS v3.1 Base Score of 7.8 (HIGH) with the vector string CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H. Under CVSS v2.0, it was rated even higher with a Base Score of 9.3 (HIGH) and vector string (AV:N/AC:M/Au:N/C:C/I:C/A:C). The vulnerability requires user interaction for successful exploitation (NVD).

If successfully exploited, this vulnerability could allow remote code execution on the affected system. The attacker could gain the same level of access rights as the logged-in user, potentially leading to complete system compromise with high impacts on confidentiality, integrity, and availability (NVD).

The vulnerability requires user interaction to be exploited, specifically through opening a specially crafted Office file. The attack complexity is considered low, and no privileges are required for exploitation, though local access to the system is necessary (NVD).

Microsoft released security updates to address this vulnerability as part of their December 2020 security updates. The fix is available through Microsoft Update, Microsoft Update Catalog, and Microsoft Download Center. For Office Online Server, the security update 4486750 was released to patch this vulnerability (Microsoft Support).