5.5med
CVE-2017-11877
Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Serv…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.1 · NVD
CISA KEV
No
not known exploited
EPSS
4.5%
percentile 92%
Public exploits
0
none known
Summary
Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Viewer 2007 Service Pack 3, and Microsoft Excel 2016 for Mac allow a security feature bypass by not enforcing macro settings on an Excel document, aka "Microsoft Excel Security Feature Bypass Vulnerability".
Exploit prediction (EPSS)
4.55% probability of exploitation in the next 30 days, higher than 92% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.1 | 5.5 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Affected products
- Microsoft Corporation Microsoft Office
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-11877 · x_refsource_CONFIRM, x_transferred
- securitytracker.com /id/1039783 · vdb-entry, x_refsource_SECTRACK, x_transferred
- securityfocus.com /bid/101747 · vdb-entry, x_refsource_BID, x_transferred
Sources
- CVE List: CVE-2017-11877
- NVD: CVE-2017-11877
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.