Vulnerability Details : CVE-2012-1854
Untrusted search path vulnerability in VBE6.dll in Microsoft Office 2003 SP3, 2007 SP2 and SP3, and 2010 Gold and SP1; Microsoft Visual Basic for Applications (VBA); and Summit Microsoft Visual Basic for Applications SDK allows local users to gain privileges via a Trojan horse DLL in the current working directory, as demonstrated by a directory that contains a .docx file, aka "Visual Basic for Applications Insecure Library Loading Vulnerability," as exploited in the wild in July 2012.
Exploit prediction scoring system (EPSS) score for CVE-2012-1854
Probability of exploitation activity in the next 30 days: 0.05%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 15 % EPSS Score History EPSS FAQ
CVSS scores for CVE-2012-1854
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
6.9
|
MEDIUM | AV:L/AC:M/Au:N/C:C/I:C/A:C |
3.4
|
10.0
|
NIST |
References for CVE-2012-1854
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2012/ms12-046
Microsoft Security Bulletin MS12-046 - Important | Microsoft Docs
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A14950
Repository / Oval Repository
-
http://www.us-cert.gov/cas/techalerts/TA12-192A.html
Microsoft Updates for Multiple Vulnerabilities | CISAUS Government Resource
Products affected by CVE-2012-1854
- cpe:2.3:a:microsoft:office:2003:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2007:sp2:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2010:sp1:x64:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2007:sp3:*:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2010:*:x86:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2010:sp1:x86:*:*:*:*:*
- cpe:2.3:a:microsoft:office:2010:sp1:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_basic_for_applications:*:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:visual_basic_for_applications_sdk:*:*:*:*:*:*:*:*