5.4med
CVE-2017-0195
Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
5.4
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
4.3%
percentile 91%
Public exploits
0
none known
Summary
Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft Office XSS Elevation of Privilege Vulnerability."
Exploit prediction (EPSS)
4.34% probability of exploitation in the next 30 days, higher than 91% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.4 | CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 3.5 | AV:N/AC:M/Au:S/C:N/I:P/A:N |
Affected products
- Microsoft Corporation Office
Classification
- Weakness
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
- securityfocus.com /bid/97417 · vdb-entry, x_refsource_BID, x_transferred
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-0195 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-0195
- NVD: CVE-2017-0195
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.