CVE-2017-8710 — XML External Entity (XXE) Injection in Corporation Microsoft Common Console Document
Severity
5.5MEDIUMNVD
EPSS
33.1%
top 3.08%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
Timeline
PublishedSep 13
Latest updateMay 13
Description
The Microsoft Common Console Document (.msc) in Microsoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1 allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity, aka "Windows Information Disclosure Vulnerability".
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.8 | Impact: 3.6
Affected Packages9 packages
▶CVEListV5microsoft_corporation/microsoft_common_console_documentMicrosoft Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1.