CVE-2017-11876

Published: Nov 15, 2017 Last Modified: Apr 20, 2025 EU-VD ID: EUVD-2017-3473 Aliases: GSD-2017-11876

ExploitDB:

Other exploit source:

Google Dorks:

HIGH 8,8

Source: [email protected]

Attack Vector: network

Attack Complexity: low

Privileges Required: none

User Interaction: required

Scope: unchanged

Confidentiality: high

Integrity: high

Availability: high

MEDIUM 6,8

Source: [email protected]

Access Vector: network

Access Complexity: medium

Authentication: none

Confidentiality: partial

Integrity: partial

Availability: partial

Description

AI Translation Available

Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim, aka 'Microsoft Project Server Elevation of Privilege Vulnerability'.

EPSS (Exploit Prediction Scoring System)

Trend Analysis

EPSS (Exploit Prediction Scoring System)

Prevede la probabilità di sfruttamento basata su intelligence sulle minacce e sulle caratteristiche della vulnerabilità.

EPSS Score

0,0098

Percentile

0,8th

Updated

EPSS Score Trend (Last 90 Days)

352

Cross-Site Request Forgery (CSRF)

Stable

Abstraction: Compound Structure: Composite

Common Consequences

Security Scopes Affected:

Confidentiality Integrity Availability Non-Repudiation Access Control

Potential Impacts:

Gain Privileges Or Assume Identity Bypass Protection Mechanism Read Application Data Modify Application Data Dos: Crash, Exit, Or Restart

Applicable Platforms

Technologies: Web Based, Web Server

Likelihood of Exploit: Medium

View CWE Details

Application

Project Server by Microsoft

Product Information

Vendor Microsoft

Product Project Server

Version 2013

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:microsoft:project_server:2013:sp1:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

Application

Sharepoint Enterprise Server by Microsoft

Product Information

Vendor Microsoft

Product Sharepoint Enterprise Server

Version 2016

CPE Identifier

View Detailed Analysis


                  cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*

Common Platform Enumeration - Standardized vulnerability identification

https://portal.msrc.microsoft.com/en-US/security-guidance/a…

Issue Tracking Patch Vendor Advisory

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-118…

http://www.securityfocus.com/bid/101754