CVE-2017-11877 : Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Micros

Microsoft Excel 2007 Service Pack 3, Microsoft Excel 2010 Service Pack 2, Microsoft Excel 2013 Service Pack 1, Microsoft Excel 2013 RT Service Pack 1, Microsoft Excel 2016, Microsoft Office Compatibility Pack Service Pack 3, Microsoft Excel Viewer 2007 Service Pack 3, and Microsoft Excel 2016 for Mac allow a security feature bypass by not enforcing macro settings on an Excel document, aka "Microsoft Excel Security Feature Bypass Vulnerability".

Published 2017-11-15 03:29:02

Updated 2023-10-03 15:38:08

Source Microsoft Corporation

View at NVD, CVE.org

Products affected by CVE-2017-11877

Microsoft » Excel » Version: 2007
cpe:2.3:a:microsoft:excel:2007:*:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2010
cpe:2.3:a:microsoft:excel:2010:*:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2013 Update SP1
cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2013
cpe:2.3:a:microsoft:excel:2013:*:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2016
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*
Matching versions
Microsoft » Excel » Version: 2016 For Mac Os X
cpe:2.3:a:microsoft:excel:2016:*:*:*:*:mac_os_x:*:*
Matching versions
Microsoft » Excel Viewer » Version: 2007 Update SP3
cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*
Matching versions
Microsoft » Office Compatibility Pack » Version: N/A Update SP3
cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2017-11877

EPSS FAQ

15.48%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 94 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2017-11877

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
5.5	MEDIUM	CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: High Availability: None
5.5	MEDIUM	CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N	1.8	3.6	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: High Availability: None

References for CVE-2017-11877

http://www.securitytracker.com/id/1039783

Microsoft Excel Bugs Let Remote Users Bypass Security and Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

CVEs referencing this url
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11877

CVE-2017-11877 | Microsoft Office Excel Security Feature Bypass
Issue Tracking;Patch;Vendor Advisory
http://www.securityfocus.com/bid/101747

Microsoft Excel CVE-2017-11877 Security Bypass Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2017-11877

Products affected by CVE-2017-11877

Exploit prediction scoring system (EPSS) score for CVE-2017-11877

CVSS scores for CVE-2017-11877

References for CVE-2017-11877