Lucene search

MicrosoftCVE-2018-0907

HistoryMar 14, 2018 - 5:29 p.m.

CVE-2018-0907

2018-03-1417:29:02

microsoft

web.nvd.nist.gov

cve-2018-0907

microsoft excel

security feature bypass

nvd

macro settings

CVSS2

6.8

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

PARTIAL

Availability Impact

PARTIAL

AV:N/AC:M/Au:N/C:P/I:P/A:P

CVSS3

7.8

Attack Vector

LOCAL

Attack Complexity

LOW

Privileges Required

NONE

User Interaction

REQUIRED

Scope

UNCHANGED

Confidentiality Impact

HIGH

Integrity Impact

HIGH

Availability Impact

HIGH

CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

AI Score

7.5

Confidence

High

EPSS

0.004

Percentile

72.6%

JSON

Microsoft Excel 2007 SP3, Microsoft Excel 2010 SP2, Microsoft Excel 2013 SP1, Microsoft Excel 2016, Microsoft Office 2016 Click-to-Run and Microsoft Office 2016 for Mac allow a security feature bypass vulnerability due to how macro settings are enforced, aka “Microsoft Office Excel Security Feature Bypass”.

Affected configurations

Nvd

Vulners

Node

microsoftexcelMatch2007sp2

microsoftexcelMatch2007sp3

microsoftexcelMatch2013sp1

microsoftexcelMatch2016

microsoftofficeMatch2016mac_os_x

microsoftofficeMatch2016click-to-run

VendorProductVersionCPE
microsoftexcel2007cpe:2.3:a:microsoft:excel:2007:sp2:*:*:*:*:*:*
microsoftexcel2007cpe:2.3:a:microsoft:excel:2007:sp3:*:*:*:*:*:*
microsoftexcel2013cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*
microsoftexcel2016cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*
microsoftoffice2016cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac_os_x:*:*
microsoftoffice2016cpe:2.3:a:microsoft:office:2016:*:*:*:click-to-run:*:*:*

Vendor	Product	Version	CPE
microsoft	excel	2007	cpe:2.3:a:microsoft:excel:2007:sp2::::::
microsoft	excel	2007	cpe:2.3:a:microsoft:excel:2007:sp3::::::
microsoft	excel	2013	cpe:2.3:a:microsoft:excel:2013:sp1::::::
microsoft	excel	2016	cpe:2.3:a:microsoft:excel:2016:::::::*
microsoft	office	2016	cpe:2.3:a:microsoft:office:2016:::::mac_os_x::
microsoft	office	2016	cpe:2.3:a:microsoft:office:2016::::click-to-run:::

CNA Affected

[
  {
    "product": "Microsoft Excel",
    "vendor": "Microsoft Corporation",
    "versions": [
      {
        "status": "affected",
        "version": "Microsoft Excel 2007 SP3, Microssoft Excel 2010 SP2, Microsoft Excel 2013 SP1, Microsoft Excel 2016, Microsoft Office 2016 Click-to-Run and Microsoft Office 2016 for Mac"
      }
    ]
  }
]