CVE-2017-0195: Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server…

Description

Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft Office XSS Elevation of Privilege Vulnerability."

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack vector

Network

Complexity

Low

Privileges

Low

User interaction

Required

Confidentiality

Low

Integrity

Low

Availability

None

Scope

Changed

Exploitation

Is it being used?

Exploit prediction (EPSS)3.8% · higher than 90% of CVEs

Exploited in the wildNo evidence yet

CISA KEVNot listed

Ransomware campaign useNot known

Affected products

Which versions

SH

SharePoint · Microsoft

2010; 2010 · source: NVD

EW

Excel Web App · Microsoft

2010 · source: NVD

OO

Office Online Server · Microsoft

All versions, or not specified · source: NVD

OW

Office Web Apps · Microsoft

2010 · source: NVD

OW

Office Web Apps Server · Microsoft

2013 · source: NVD