6.4med
CVE-2007-6329
Microsoft Office 2007 12.0.6015.5000 and MSO 12.0.6017.5000 do not sign the metadata of Office Open XML (OOXML) documents, which makes it e…
Published 18 y ago · modified 4 mo ago · JSON
CVSS
6.4
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
15.6%
percentile 97%
Public exploits
0
none known
Summary
Microsoft Office 2007 12.0.6015.5000 and MSO 12.0.6017.5000 do not sign the metadata of Office Open XML (OOXML) documents, which makes it easier for remote attackers to modify Dublin Core metadata fields, as demonstrated by the (1) LastModifiedBy and (2) creator fields in docProps/core.xml in the OOXML ZIP container.
Exploit prediction (EPSS)
15.60% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 2.0 | 6.4 | AV:N/AC:L/Au:N/C:P/I:P/A:N |
Classification
- Weakness
- CWE-255 Credentials Management Errors
References
- securityreason.com /securityalert/3443 · third-party-advisory, x_refsource_SREASON, x_transferred
- exchange.xforce.ibmcloud.com /vulnerabilities/39021 · vdb-entry, x_refsource_XF, x_transferred
- securityfocus.com /bid/26833 · vdb-entry, x_refsource_BID, x_transferred
- securityfocus.com /archive/1/484919/100/0/threaded · mailing-list, x_refsource_BUGTRAQ, x_transferred
- osvdb.org /44938 · vdb-entry, x_refsource_OSVDB, x_transferred
Sources
- CVE List: CVE-2007-6329
- NVD: CVE-2007-6329
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.