7.8high
CVE-2017-11882KEV · ransomwarein critical feed2 exploits
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016…
Published 8 y ago · modified 4 mo ago · JSON
CVSS
7.8
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
99.9%
percentile 100%
Public exploits
2
Metasploit · Exploit-DB
Summary
Microsoft Office 2007 Service Pack 3, Microsoft Office 2010 Service Pack 2, Microsoft Office 2013 Service Pack 1, and Microsoft Office 2016 allow an attacker to run arbitrary code in the context of the current user by failing to properly handle objects in memory, aka "Microsoft Office Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-11884.
Known exploited (CISA KEV)
- Added
- 5 y ago
- Due date
- 2022-05-03 (4 y ago)
- Ransomware use
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Microsoft / Office
- CISA name
- Microsoft Office Memory Corruption Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 20 mo ago
Exploit prediction (EPSS)
99.94% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- Metasploit exploit/windows/fileformat/office_ms17_11882 Microsoft Office CVE-2017-11882 · metasploit exploit, manual rank · 2017-11-15
- EDB-43163 Microsoft Office - OLE Remote Code Execution · remote · 2017-11-20
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.8 | CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 9.3 | AV:N/AC:M/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Corporation Microsoft Office
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- github.com /embedi/CVE-2017-11882 · x_refsource_MISC, x_transferred
- github.com /unamer/CVE-2017-11882 · x_refsource_MISC, x_transferred
- reversingminds-blog.logdown.com /posts/3907313-fileless-attack-in-word-without-macros-cve-2017-11882 · x_refsource_MISC, x_transferred
- github.com /rxwx/CVE-2017-11882 · x_refsource_MISC, x_transferred
- securityfocus.com /bid/101757 · vdb-entry, x_refsource_BID, x_transferred
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-11882 · x_refsource_CONFIRM, x_transferred
- researchcenter.paloaltonetworks.com /2017/12/unit42-analysis-of-cve-2017-11882-exploit-in-the-wild/ · x_refsource_MISC, x_transferred
- securitytracker.com /id/1039783 · vdb-entry, x_refsource_SECTRACK, x_transferred
- kb.cert.org /vuls/id/421280 · third-party-advisory, x_refsource_CERT-VN, x_transferred
- 0patch.blogspot.com /2017/11/did-microsoft-just-manually-patch-their.html · x_refsource_MISC, x_transferred
- 0patch.blogspot.com /2017/11/official-patch-for-cve-2017-11882-meets.html · x_refsource_MISC, x_transferred
- github.com /0x09AL/CVE-2017-11882-metasploit · x_refsource_MISC, x_transferred
- exploit-db.com /exploits/43163/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
- web.archive.org /web/20181104111128/https://embedi.com/blog/skeleton-closet-ms-office-vulnerability-you-di · x_refsource_MISC, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11882 · government-resource
Sources
- CVE List: CVE-2017-11882
- NVD: CVE-2017-11882
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.