CVE-2017-11768 — Sensitive Information Exposure in Corporation Windows Media Player

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
2.5LOWNVD
EPSS
1.5%
top 18.61%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
15
Microsoft Corporation Windows Media PlayerMsrc Windows 10Msrc Windows 10 Version 1511+12 more
Timeline
PublishedNov 15
Latest updateMay 17

Description

Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709 allows remote attackers to test for the presence of files on disk via a specially crafted application. due to the way Windows Media Player discloses file information, aka "Windows Media Player Information Disclosure Vulnerability."

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:NExploitability: 1.0 | Impact: 1.4

Affected Packages15 packages

▶CVEListV5microsoft_corporation/windows_media_playerWindows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016, and Windows Server, version 1709.

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-9hg9-45xx-r2q2: Windows Media Player in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, Windows 8↗2022-05-17
▶

📋Vendor Advisories

1
Microsoft
Windows Media Player Information Disclosure Vulnerability↗2017-11-14
▶

🕵️Threat Intelligence

1
Talos
Microsoft Patch Tuesday - November 2017↗2017-11-14
▶