Cross-site request forgery in Microsoft Project Server - CVE-2017-11876
Published: November 14, 2017 / Updated: November 14, 2017
Vulnerability identifier: #VU9314
CSH Severity: Low
CVSS v4: 8.5 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]
CVE-ID: CVE-2017-11876
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote authenticated attacker to perform CSRF attack.
The vulnerability exists due to improper management of user sessions by Microsoft Project Server. A remote attacker can trick the victim to follow a specially crafted link typically by way of an enticement in an email or Instant Messenger message and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of the vulnerability results in privilege escalation.
Affected software
Microsoft Project Server
Microsoft SharePoint Server
Microsoft SharePoint Server
How to mitigate CVE-2017-11876
Install updates from vendor's website.