CVE-2017-11777 — MEDIUM (5.4)

Vulnerability Description

Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted request to an affected SharePoint server, due to how SharePoint Server sanitizes web requests, aka "Microsoft Office SharePoint XSS Vulnerability". This CVE ID is unique from CVE-2017-11775 and CVE-2017-11820.

CVSS Score

5.4

MEDIUM

CVSS:3.0/AV:N/AC:L/PR:L/UI:R/S:C/C:L/I:L/A:N

Attack Vector

NETWORK

Attack Complexity

LOW

Privileges Required

LOW

User Interaction

REQUIRED

Scope

CHANGED

Confidentiality

LOW

Integrity

LOW

Availability

NONE

Affected Products

Vendor	Product	Versions
Microsoft	Sharepoint Enterprise Server	2013

Related Weaknesses (CWE)

CWE-79

References

http://www.securityfocus.com/bid/101155Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039540Third Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-1177PatchVendor Advisory
http://www.securityfocus.com/bid/101155Third Party AdvisoryVDB Entry
http://www.securitytracker.com/id/1039540Third Party AdvisoryVDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-1177PatchVendor Advisory

FAQ

What is CVE-2017-11777?

CVE-2017-11777 is a vulnerability with a CVSS score of 5.4 (MEDIUM). Microsoft SharePoint Enterprise Server 2013 SP1 and Microsoft SharePoint Enterprise Server 2016 allow an attacker to exploit a cross-site scripting (XSS) vulnerability by sending a specially crafted r...

How severe is CVE-2017-11777?

CVE-2017-11777 has been rated MEDIUM with a CVSS base score of 5.4/10. Review the CVSS metrics above for detailed severity breakdown.

Is there a patch for CVE-2017-11777?

Check the references section above for vendor advisories and patch information. Affected products include: Microsoft Sharepoint Enterprise Server.