Unscored severity · published Jul 15, 2009
CVE-2009-1136
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office…
–
CVSS
62%
EPSS
No
On KEV
Description
The Microsoft Office Web Components Spreadsheet ActiveX control (aka OWC10 or OWC11), as distributed in Office XP SP3 and Office 2003 SP3, Office XP Web Components SP3, Office 2003 Web Components SP3, Office 2003 Web Components SP1 for the 2007 Microsoft Office System, Internet Security and Acceleration (ISA) Server 2004 SP3 and 2006 Gold and SP1, and Office Small Business Accounting 2006, when used in Internet Explorer, allows remote attackers to execute arbitrary code via a crafted call to the msDataSourceObject method, as exploited in the wild in July and August 2009, aka "Office Web Components HTML Script Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)62.0% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
OF
Office · Microsoft
2003; 2003 · source: NVD
IS
Isa Server · Microsoft
2004; 2004; 2006; 2006; 2006 · source: NVD
OW
Office Web Components · Microsoft
2003; 2003; xp · source: NVD
OX
Office XP · Microsoft
sp3 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2009-1136
CVE.org
https://www.cve.org/CVERecord?id=CVE-2009-1136
blogs.technet.com
http://blogs.technet.com/msrc/archive/2009/07/13/microsoft-security-advisory-973472-released.aspx
blogs.technet.com
http://blogs.technet.com/srd/archive/2009/07/13/more-information-about-the-office-web-components-activex-vulnerability.aspx
isc.sans.org
http://isc.sans.org/diary.html?storyid=6778
Exploit
http://trac.metasploit.com/browser/framework3/trunk/modules/exploits/windows/browser/owc_spreadsheet_msdso.rb
Vendor Advisory
http://www.microsoft.com/technet/security/advisory/973472.mspx
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA09-223A.html
More from Office
9.8
CVE-2024-21413
Microsoft Outlook Remote Code Execution Vulnerability
9.8
CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
8.8
CVE-2024-38189
Microsoft Project Remote Code Execution Vulnerability
8.8
CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
8.8
CVE-2019-1297
Microsoft Excel Remote Code Execution Vulnerability