CVE-2021-40454medium

CVE-2021-40454: medium-severity vulnerability in Microsoft 365 Apps for Enterprise

Rich Text Edit Control Information Disclosure Vulnerability

Published · Updated

13Vexday Risk Score

No sign of exploitation. No public exploitation artifact known so far.

ssvc Trackcvss 5.5epss 0.5%
exploitation probability
0.5%top 59% of all CVEs
observed exploitation
nono source reports it
Rich Text Edit Control Information Disclosure Vulnerability
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N/E:F/RL:O/RC:C
Affected products
Microsoft · Microsoft 365 Apps for EnterpriseMicrosoft · Microsoft Office 2013 Service Pack 1Microsoft · Microsoft Office 2016Microsoft · Microsoft Office 2019Microsoft · Microsoft Office 2019 for MacMicrosoft · Microsoft Office LTSC 2021Microsoft · Microsoft Office LTSC for Mac 2021Microsoft · Windows 10 Version 1507Microsoft · Windows 10 Version 1607Microsoft · Windows 10 Version 1809Microsoft · Windows 10 Version 1909Microsoft · Windows 10 Version 2004Microsoft · Windows 10 Version 20H2Microsoft · Windows 10 Version 21H1Microsoft · Windows 11 version 21H2Microsoft · Windows 8.1Microsoft · Windows Server 2012Microsoft · Windows Server 2012 R2Microsoft · Windows Server 2012 R2 (Server Core installation)Microsoft · Windows Server 2012 (Server Core installation)Microsoft · Windows Server 2016Microsoft · Windows Server 2016 (Server Core installation)Microsoft · Windows Server 2019Microsoft · Windows Server 2019 (Server Core installation)Microsoft · Windows Server 2022Microsoft · Windows Server version 2004Microsoft · Windows Server version 20H2
Related CVEs — Microsoft 365 Apps for Enterprise

In the same product, most dangerous first.

CVE-2023-23397CRITICALMicrosoft Outlook Elevation of Privilege VulnerabilityEPSS 97.2%KEVCVE-2024-21413CRITICALMicrosoft Outlook Remote Code Execution VulnerabilityEPSS 94.7%KEVCVE-2026-21509HIGHMicrosoft Office Security Feature Bypass VulnerabilityEPSS 70.8%KEVCVE-2021-42292HIGHMicrosoft Excel Security Feature Bypass VulnerabilityEPSS 43.0%KEVCVE-2023-36761MEDIUMMicrosoft Word Information Disclosure VulnerabilityEPSS 19.6%KEVCVE-2023-35311HIGHMicrosoft Outlook Security Feature Bypass VulnerabilityEPSS 15.5%KEV
References
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2021-40454