⚠️ CISA Known Exploited Vulnerability
Active ThreatThis vulnerability is listed in CISA's Known Exploited Vulnerabilities (KEV) catalog. Active exploitation has been observed in the wild. This poses significant risk to federal enterprises and should be prioritized for immediate patching.
CVE-2017-11774
High CISA KEVVulnerability Description
Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."
CVSS Metrics
Common Vulnerability Scoring System
Vector String:
CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Known Affected Software
3 configuration(s) from 1 vendor(s)
cpe:2.3:a:microsoft:outlook:2013:-:-:*:-:-:*:*
cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*
cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:x64:*
References & Resources
-
http://www.securityfocus.com/bid/101098secure@microsoft.com Broken Link Third Party Advisory VDB Entry
-
http://www.securitytracker.com/id/1039542secure@microsoft.com Broken Link Third Party Advisory VDB Entry
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774secure@microsoft.com Patch Vendor Advisory
-
https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/secure@microsoft.com Exploit
-
http://www.securityfocus.com/bid/101098af854a3a-2127-422b-91ae-364da2661108 Broken Link Third Party Advisory VDB Entry
-
http://www.securitytracker.com/id/1039542af854a3a-2127-422b-91ae-364da2661108 Broken Link Third Party Advisory VDB Entry
-
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774af854a3a-2127-422b-91ae-364da2661108 Patch Vendor Advisory
-
https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/af854a3a-2127-422b-91ae-364da2661108 Exploit
-
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774134c704f-9b21-4f2e-91b3-4a467353bcc0
Severity Details
CISA KEV Status
Listed in CISA's Known Exploited Vulnerabilities catalog
Key Information
- Published Date
- October 13, 2017
