CVE-2017-11877

4 documents4 sources
Severity
5.5MEDIUM
EPSS
12.0%
top 6.23%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Microsoft Corporation Microsoft OfficeMicrosoft ExcelMicrosoft Excel Viewer
Timeline
PublishedNov 15
Latest updateMay 13

Description

Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Viewer 2007 Service Pack 3, and Microsoft Excel 2016 for Mac allow a security feature bypass by not enforcing macro settings on an Excel document, aka "Microsoft Excel Security Feature Bypass Vulnerability".

CVSS vector

CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:NExploitability: 1.8 | Impact: 3.6

Affected Packages3 packages

▶NVDmicrosoft/excel4 versions+3
▶CVEListV5microsoft_corporation/microsoft_officeMicrosoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Viewer 2007 Service Pack 3, and Microsoft Excel 2016 for Mac

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-gp6j-38cw-3x32: Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1,↗2022-05-13
▶
CVEList
CVE-2017-11877: Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1,↗2017-11-15
▶

📋Vendor Advisories

1
Microsoft
Microsoft Office Excel Security Feature Bypass↗2017-11-14
▶
CVE-2017-11877 (MEDIUM CVSS 5.5) | Microsoft Excel 2007 Service Pack 3 | cvebase.io