Cross-site request forgery in Microsoft Project Server - CVE-2017-11876
Published: November 14, 2017 / Updated: November 14, 2017
Vulnerability identifier: #VU9314
CSH Severity: Low
CVSS v4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-11876
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vendor: Microsoft
Affected software:
Microsoft Project Server
Microsoft Project Server
Detailed vulnerability description
The vulnerability allows a remote authenticated attacker to perform CSRF attack.
The vulnerability exists due to improper management of user sessions by Microsoft Project Server. A remote attacker can trick the victim to follow a specially crafted link typically by way of an enticement in an email or Instant Messenger message and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of the vulnerability results in privilege escalation.
How to mitigate CVE-2017-11876
Install updates from vendor's website.