cnvd-2017-05761
Vulnerability from cnvd
Title
Microsoft Office XSS权限提升漏洞
Description
Microsoft Office是微软公司开发的一套基于Windows操作系统的办公软件套装。 Office Web Apps服务器未正确过滤构造的请求存在权限提升漏洞，攻击者可在受影响系统上执行跨站脚本攻击。
Severity
低
Patch Name
Microsoft Office XSS权限提升漏洞的补丁
Patch Description
Microsoft Office是微软公司开发的一套基于Windows操作系统的办公软件套装。 Office Web Apps服务器未正确过滤构造的请求存在权限提升漏洞，攻击者可在受影响系统上执行跨站脚本攻击。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。
Formal description

Microsoft已经为此发布了一个安全公告（CVE-2017-0195）以及相应补丁: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0195

Reference
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0195
Impacted products
Name
['Microsoft SharePoint Server 2010 SP1', 'Microsoft Office Web Apps 2010 SP2', 'Microsoft Excel 2010 SP2', 'Microsoft SharePoint Server 2010 SP2', 'Microsoft Office Web Apps Server 2013 SP1', 'Microsoft Office Online Server']
Show details on source website

To clipboard 

{
  "bids": {
    "bid": {
      "bidNumber": "97417"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2017-0195"
    }
  },
  "description": "Microsoft Office\u662f\u5fae\u8f6f\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u5957\u57fa\u4e8eWindows\u64cd\u4f5c\u7cfb\u7edf\u7684\u529e\u516c\u8f6f\u4ef6\u5957\u88c5\u3002\r\n\r\nOffice Web Apps\u670d\u52a1\u5668\u672a\u6b63\u786e\u8fc7\u6ee4\u6784\u9020\u7684\u8bf7\u6c42\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5728\u53d7\u5f71\u54cd\u7cfb\u7edf\u4e0a\u6267\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002",
  "discovererName": "Ashar Javed (@soaj1664ashar), Hyundai AutoEver Europe GmbH.",
  "formalWay": "Microsoft\u5df2\u7ecf\u4e3a\u6b64\u53d1\u5e03\u4e86\u4e00\u4e2a\u5b89\u5168\u516c\u544a\uff08CVE-2017-0195\uff09\u4ee5\u53ca\u76f8\u5e94\u8865\u4e01:\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0195",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2017-05761",
  "openTime": "2017-05-02",
  "patchDescription": "Microsoft Office\u662f\u5fae\u8f6f\u516c\u53f8\u5f00\u53d1\u7684\u4e00\u5957\u57fa\u4e8eWindows\u64cd\u4f5c\u7cfb\u7edf\u7684\u529e\u516c\u8f6f\u4ef6\u5957\u88c5\u3002\r\n\r\nOffice Web Apps\u670d\u52a1\u5668\u672a\u6b63\u786e\u8fc7\u6ee4\u6784\u9020\u7684\u8bf7\u6c42\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff0c\u653b\u51fb\u8005\u53ef\u5728\u53d7\u5f71\u54cd\u7cfb\u7edf\u4e0a\u6267\u884c\u8de8\u7ad9\u811a\u672c\u653b\u51fb\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Office XSS\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft SharePoint Server 2010 SP1",
      "Microsoft Office Web Apps 2010 SP2",
      "Microsoft Excel 2010 SP2",
      "Microsoft SharePoint Server 2010 SP2",
      "Microsoft Office Web Apps Server 2013 SP1",
      "Microsoft Office Online Server"
    ]
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0195",
  "serverity": "\u4f4e",
  "submitTime": "2017-04-14",
  "title": "Microsoft Office XSS\u6743\u9650\u63d0\u5347\u6f0f\u6d1e"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.




Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Published Proof of Concept: A public proof of concept is available for this vulnerability.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.