Vulnerability Details : CVE-2017-0045
Potential exploit
Windows DVD Maker in Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2 does not properly parse crafted .msdvd files, which allows attackers to obtain information to compromise a target system, aka "Windows DVD Maker Cross-Site Request Forgery Vulnerability."
Vulnerability category: Cross-site request forgery (CSRF)
Products affected by CVE-2017-0045
- cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
- cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2017-0045
3.67%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 92 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2017-0045
Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
---|---|---|---|---|---|---|
4.3
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:N/A:N |
8.6
|
2.9
|
NIST | |
5.5
|
MEDIUM | CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N |
1.8
|
3.6
|
NIST |
CWE ids for CVE-2017-0045
-
The web application does not, or can not, sufficiently verify whether a well-formed, valid, consistent request was intentionally provided by the user who submitted the request.Assigned by: nvd@nist.gov (Primary)
References for CVE-2017-0045
-
http://www.securityfocus.com/bid/96103
Microsoft Windows DVD Maker CVE-2017-0045 Cross Site Request Forgery VulnerabilityThird Party Advisory;VDB Entry
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0045
CVE-2017-0045 | Windows DVD Maker Cross-Site Request Forgery VulnerabilityPatch;Vendor Advisory
-
http://hyp3rlinx.altervista.org/advisories/MICROSOFT-DVD-MAKER-XML-EXTERNAL-ENTITY-FILE-DISCLOSURE.txt
Exploit;Third Party Advisory
-
https://www.exploit-db.com/exploits/41619/
Microsoft Windows DVD Maker 6.1.7 - XML External Entity Injection
-
http://www.securitytracker.com/id/1038015
Windows DVD Maker Access Control Flaw Lets Remote Users Conduct Cross-Site Request Forgery Attacks - SecurityTracker
Jump to