Lucene search

[email protected]CVE-2017-0195

HistoryApr 12, 2017 - 2:59 p.m.

CVE-2017-0195

2017-04-1214:59:01

CWE-79

[email protected]

web.nvd.nist.gov

cve-2017-0195

microsoft

excel

sharepoint

server

web apps

office web apps

xss

elevation of privilege

vulnerability

nvd

5.4 Medium

CVSS3

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality Impact

LOW

Integrity Impact

LOW

Availability Impact

NONE

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

5.2 Medium

AI Score

Confidence

High

3.5 Low

CVSS2

Access Vector

Access Complexity

Authentication

SINGLE

Confidentiality Impact

NONE

Integrity Impact

PARTIAL

Availability Impact

NONE

AV:N/AC:M/Au:S/C:N/I:P/A:N

0.002 Low

EPSS

Percentile

53.3%

JSON

Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka “Microsoft Office XSS Elevation of Privilege Vulnerability.”

Affected configurations

Vulners

NVD

Node

microsoft_corporationoffice

CPENameOperatorVersion
microsoft:excel_web_appmicrosoft excel web appeq2010
microsoft:office_online_servermicrosoft office online servereq*
microsoft:office_web_appsmicrosoft office web appseq2010
microsoft:office_web_apps_servermicrosoft office web apps servereq2013
microsoft:sharepoint_servermicrosoft sharepoint servereq2010

CPE	Name	Operator	Version
microsoft:excel_web_app	microsoft excel web app	eq	2010
microsoft:office_online_server	microsoft office online server	eq	*
microsoft:office_web_apps	microsoft office web apps	eq	2010
microsoft:office_web_apps_server	microsoft office web apps server	eq	2013
microsoft:sharepoint_server	microsoft sharepoint server	eq	2010

CNA Affected

[
  {
    "product": "Office",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1, and Office Online Server"
      }
    ]
  }
]