High severity · published Oct 13, 2017
CVE-2017-11774
Microsoft Office Outlook Security Feature Bypass Vulnerability
In wildKEV
7.8
CVSS
59.6%
EPSS
Yes
On KEV
Description
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
CVSS vector
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)59.6% · higher than 99% of CVEs
Exploited in the wildYes
CISA KEVListed Nov 3, 2021
Federal remediation dueMay 3, 2022
Ransomware campaign useNot known
Affected products
Which versions
OU
Outlook · Microsoft
Microsoft Outlook 2010 SP2; Outlook 2013 SP1 and RT SP1; Outlook 2016 · source: vendor, NVD
OF
Office · Microsoft
All versions, or not specified · source: KEV
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2017-11774
CVE.org
https://www.cve.org/CVERecord?id=CVE-2017-11774
CISA KEV catalogue
https://www.cisa.gov/known-exploited-vulnerabilities-catalog
x_refsource_CONFIRM
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774
vdb-entry
http://www.securityfocus.com/bid/101098
vdb-entry
http://www.securitytracker.com/id/1039542
x_refsource_MISC
https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/
More from Outlook
9.8
CVE-2023-23397
Microsoft Outlook Elevation of Privilege Vulnerability
8.8
CVE-2023-35311
Microsoft Outlook Security Feature Bypass Vulnerability
8.8
CVE-2007-0671
Microsoft Office Excel Remote Code Execution Vulnerability
7.8
CVE-2015-1641
Microsoft Office Memory Corruption Vulnerability
9.1
CVE-2024-42220
A library injection vulnerability exists in Microsoft Outlook 16.83.3 for macOS