CVE-2017-11774

HIGHCISA KEV

7.8

Description

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

Details CVE

Score CVSS v3.17.8

SeveriteHIGH

Vecteur CVSSCVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Vecteur d'attaqueLOCAL

ComplexiteLOW

Privileges requisNONE

Interaction utilisateurREQUIRED

Publie10/13/2017

Derniere modification4/22/2026

Sourcekev

Observations honeypot0

CISA KEV

FournisseurMicrosoft

ProduitOffice

Nom vulnerabiliteMicrosoft Office Outlook Security Feature Bypass Vulnerability

Date ajout KEV2021-11-03

Date limite remediation2022-05-03

Utilise dans ransomwareUnknown

Produits affectes

microsoft:outlook

Faiblesses (CWE)

CWE-119CWE-119

References

http://www.securityfocus.com/bid/101098(secure@microsoft.com)

http://www.securitytracker.com/id/1039542(secure@microsoft.com)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774(secure@microsoft.com)

https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/(secure@microsoft.com)

http://www.securityfocus.com/bid/101098(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1039542(af854a3a-2127-422b-91ae-364da2661108)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774(af854a3a-2127-422b-91ae-364da2661108)

https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774(134c704f-9b21-4f2e-91b3-4a467353bcc0)

Correlations IOC

Aucune correlation enregistree

This product uses data from the NVD API but is not endorsed or certified by the NVD.