5.5med
CVE-2017-8710
The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbi…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
5.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
10.4%
percentile 96%
Public exploits
0
none known
Summary
The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity, aka "Windows Information Disclosure Vulnerability".
Exploit prediction (EPSS)
10.44% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 5.5 | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Affected products
- Microsoft Corporation Microsoft Common Console Document (.msc)
Classification
- Weakness
- CWE-611 Improper Restriction of XML External Entity Reference
References
- securityfocus.com /bid/100793 · vdb-entry, x_refsource_BID, x_transferred
- youtube.com /watch?v=bIFot3a-58I · x_refsource_MISC, x_transferred
- vulnerability-lab.com /get_content.php?id=2094 · x_refsource_MISC, x_transferred
- securitytracker.com /id/1039325 · vdb-entry, x_refsource_SECTRACK, x_transferred
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-8710 · x_refsource_CONFIRM, x_transferred
Sources
- CVE List: CVE-2017-8710
- NVD: CVE-2017-8710
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.