#VU9314 Cross-site request forgery in Microsoft Project Server - CVE-2017-11876
Published: November 14, 2017 / Updated: November 14, 2017
Vulnerability identifier: #VU9314
Vulnerability risk: Low
CVSSv4.0: CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N/E:U/U:Clear
CVE-ID: CVE-2017-11876
CWE-ID: CWE-79
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerable software:
Microsoft Project Server
Microsoft Project Server
Software vendor:
Microsoft
Microsoft
Description
The vulnerability allows a remote authenticated attacker to perform CSRF attack.
The vulnerability exists due to improper management of user sessions by Microsoft Project Server. A remote attacker can trick the victim to follow a specially crafted link typically by way of an enticement in an email or Instant Messenger message and execute arbitrary HTML and script code in user's browser in context of vulnerable website.
Successful exploitation of the vulnerability results in privilege escalation.
Remediation
Install updates from vendor's website.