CVE-2017-11876
published 2017-11-15CVE-2017-11876: Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not…
PriorityP343high8.8CVSS 3.0
AVNACLPRNUIRSUCHIHAH
EPSS
2.47%
82.7th percentile
Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim, aka "Microsoft Project Server Elevation of Privilege Vulnerability".
Affected
5 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | project_server | — | — |
| microsoft | sharepoint_enterprise_server | — | — |
| microsoft_corporation | microsoft_server | — | — |
| msrc | microsoft_project_server_2013_service_pack_1 | — | — |
| msrc | microsoft_sharepoint_enterprise_server_2016 | — | — |
CVSS provenance
nvdv3.08.8HIGHCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
nvdv2.06.8MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:P
vendor_msrc8.8MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
Microsoft
Microsoft Project Server Elevation of Privilege Vulnerability
vendor_msrc·2017-11-14·CVSS 8.8
CVE-2017-11876 [HIGH] Microsoft Project Server Elevation of Privilege Vulnerability
Microsoft Project Server Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists in Microsoft Project when Microsoft Project Server does not properly manage user sessions. For this Cross-site Request Forgery(CSRF/XSRF) vulnerability to be exploited, the victim must be authenticated to (logged on) the target site.
In a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted webpage that is designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message.
GHSA
GHSA-hc3g-h2rv-xpmc: Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not
ghsa_unreviewed·2022-05-17
CVE-2017-11876 [HIGH] CWE-352 GHSA-hc3g-h2rv-xpmc: Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not
Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim, aka "Microsoft Project Server Elevation of Privilege Vulnerability".
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/101754http://www.securitytracker.com/id/1039788http://www.securitytracker.com/id/1039789https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11876http://www.securityfocus.com/bid/101754http://www.securitytracker.com/id/1039788http://www.securitytracker.com/id/1039789https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11876
2017-11-15
Published