CVE-2017-0195

Published: Apr 12, 2017Modified: May 13, 2026

5.4

Vector

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.3 / Impact: 2.7

Source: NVD

Description

Microsoft Excel Services on Microsoft SharePoint Server 2010 SP1 and SP2, Microsoft Excel Web Apps 2010 SP2, Microsoft Office Web Apps 2010 SP2, Microsoft Office Web Apps Server 2013 SP1 and Office Online Server allows remote attackers to perform cross-site scripting and run script with local user privileges via a crafted request, aka "Microsoft Office XSS Elevation of Privilege Vulnerability."

Affected (6)

Products: Microsoft: Excel Web App, Office Online Server, Office Web Apps, Office Web Apps Server, Sharepoint Server

5 products

Office Web Apps Server

Sharepoint Server

Configuration A

6 vulnerable

Vulnerable Software	Affected Versions
Microsoft Excel Web App	Version 2010 sp2
Microsoft Office Online Server	All versions
Microsoft Office Web Apps	Version 2010 sp2
Microsoft Office Web Apps Server	Version 2013 sp1
Microsoft Sharepoint Server	Version 2010 sp1
Microsoft Sharepoint Server	Version 2010 sp2