{
  "cveId": "CVE-2020-0695",
  "url": "https://patchblox.com/security/cve/CVE-2020-0695",
  "summary": "CVE-2020-0695 is fixed in Office Online Server on 1 platform by KB4484254 (version ), released February 11, 2020. It is not reported as exploited. Patch Radar priority: High.",
  "title": "Microsoft Office Online Server Spoofing Vulnerability",
  "description": "\u003Cp\u003EA spoofing vulnerability exists when Office Online Server does not validate origin in cross-origin communications correctly. An attacker could exploit the vulnerability by sending a specially crafted request to an affected site.\u003C/p\u003E\n\u003Cp\u003EThe attacker who successfully exploited the vulnerability could then perform cross-origin attacks on affected systems. These attacks could allow the attacker to read content that the attacker is not authorized to read, and use the victim\u0027s identity to take actions on the site on behalf of the victim. The victim needs to be authenticated for an attacker to compromise the victim.\u003C/p\u003E\n\u003Cp\u003EThe security update addresses the vulnerability by ensuring that Office Online Server properly validates origins.\u003C/p\u003E",
  "published": "2020-02-11T14:00:00Z",
  "severity": "Important",
  "epss": 0.00966,
  "epssPercentile": 0.61914,
  "priority": "High",
  "priorityTier": 3,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation Less Likely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2020-0695",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Office Online Server",
      "fixedVersion": "",
      "fix": "KB4484254",
      "url": "https://patchblox.com/security/fix/microsoft/kb4484254",
      "released": "2020-02-11T14:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T18:46:35Z",
  "attribution": {
    "text": "Data: Patchblox Patch Radar",
    "url": "https://patchblox.com/security/patch-radar",
    "terms": "https://patchblox.com/security/patch-radar/use-the-data"
  }
}