CVE-2017-11774 - Vulnerability Details - OpenCVE

Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka "Microsoft Outlook Security Feature Bypass Vulnerability."

No CVSS v4.0

Attack Vector Local

Attack Complexity Low

Privileges Required None

Scope Unchanged

Confidentiality Impact High

Integrity Impact High

Availability Impact High

User Interaction Required

No CVSS v3.0

Access Vector Network

Access Complexity Medium

Authentication None

Confidentiality Impact Partial

Integrity Impact Partial

Availability Impact Partial

This CVE is in the KEV database since Nov. 3, 2021.

Exploitation active

Automatable no

Technical Impact total

Vendors	Products
Microsoft	Outlook

Configuration 1 [-]

OR	cpe:2.3:a:microsoft:outlook:2010:sp2::::::
	cpe:2.3:a:microsoft:outlook:2013:sp1:::-:::*
	cpe:2.3:a:microsoft:outlook:2013:sp1:::rt:::*
	cpe:2.3:a:microsoft:outlook:2016:::::::*

No data.

References

Link	Providers
http://www.securityfocus.com/bid/101098
http://www.securitytracker.com/id/1039542
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774
https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/

History

Wed, 16 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.83923}`	epss `{'score': 0.81564}`

Sat, 12 Jul 2025 13:45:00 +0000

Type	Values Removed	Values Added
Metrics	epss `{'score': 0.84604}`	epss `{'score': 0.83923}`

Mon, 10 Feb 2025 20:15:00 +0000

Type	Values Removed	Values Added
Metrics		kev `{'dateAdded': '2021-11-03'}` ssvc `{'options': {'Automatable': 'no', 'Exploitation': 'active', 'Technical Impact': 'total'}, 'version': '2.0.3'}`

MITRE

Status: PUBLISHED

Assigner: microsoft

Published: 2017-10-13T13:00:00.000Z

Updated: 2025-07-30T01:46:21.306Z

Reserved: 2017-07-31T00:00:00.000Z

Link: CVE-2017-11774

Vulnrichment

Updated: 2024-08-05T18:19:39.015Z

NVD

Status : Deferred

Published: 2017-10-13T13:29:00.427

Modified: 2025-04-20T01:37:25.860

Link: CVE-2017-11774

Redhat

No data.

{"containers": {"cna": {"affected": [{"product": "Microsoft Outlook", "vendor": "Microsoft Corporation", "versions": [{"status": "affected", "version": "Microsoft Outlook 2010 SP2"}, {"status": "affected", "version": "Outlook 2013 SP1 and RT SP1"}, {"status": "affected", "version": "Outlook 2016"}]}], "datePublic": "2017-10-10T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\""}], "problemTypes": [{"descriptions": [{"description": "Security Feature Bypass", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2019-07-11T18:16:14.000Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774"}, {"name": "101098", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/101098"}, {"name": "1039542", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1039542"}, {"tags": ["x_refsource_MISC"], "url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "DATE_PUBLIC": "2017-10-10T00:00:00", "ID": "CVE-2017-11774", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Microsoft Outlook", "version": {"version_data": [{"version_value": "Microsoft Outlook 2010 SP2"}, {"version_value": "Outlook 2013 SP1 and RT SP1"}, {"version_value": "Outlook 2016"}]}}]}, "vendor_name": "Microsoft Corporation"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Security Feature Bypass"}]}]}, "references": {"reference_data": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774"}, {"name": "101098", "refsource": "BID", "url": "http://www.securityfocus.com/bid/101098"}, {"name": "1039542", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1039542"}, {"name": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/", "refsource": "MISC", "url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:19:39.015Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774"}, {"name": "101098", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/101098"}, {"name": "1039542", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1039542"}, {"tags": ["x_refsource_MISC", "x_transferred"], "url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2017-11774", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-10T14:45:34.549770Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2021-11-03", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2017-11774"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "timeline": [{"time": "2021-11-03T00:00:00+00:00", "lang": "en", "value": "CVE-2017-11774 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-07-30T01:46:21.306Z"}}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2017-11774", "datePublished": "2017-10-13T13:00:00.000Z", "dateReserved": "2017-07-31T00:00:00.000Z", "dateUpdated": "2025-07-30T01:46:21.306Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "http://www.securityfocus.com/bid/101098", "name": "101098", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"]}, {"url": "http://www.securitytracker.com/id/1039542", "name": "1039542", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"]}, {"url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/", "tags": ["x_refsource_MISC", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T18:19:39.015Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 7.8, "attackVector": "LOCAL", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2017-11774", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-10T14:45:34.549770Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2021-11-03", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-11774"}}}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-119", "description": "CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-10T14:43:39.386Z"}}], "cna": {"affected": [{"vendor": "Microsoft Corporation", "product": "Microsoft Outlook", "versions": [{"status": "affected", "version": "Microsoft Outlook 2010 SP2"}, {"status": "affected", "version": "Outlook 2013 SP1 and RT SP1"}, {"status": "affected", "version": "Outlook 2016"}]}], "datePublic": "2017-10-10T00:00:00.000Z", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://www.securityfocus.com/bid/101098", "name": "101098", "tags": ["vdb-entry", "x_refsource_BID"]}, {"url": "http://www.securitytracker.com/id/1039542", "name": "1039542", "tags": ["vdb-entry", "x_refsource_SECTRACK"]}, {"url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/", "tags": ["x_refsource_MISC"]}], "descriptions": [{"lang": "en", "value": "Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\""}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Security Feature Bypass"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2019-07-11T18:16:14.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "Microsoft Outlook 2010 SP2"}, {"version_value": "Outlook 2013 SP1 and RT SP1"}, {"version_value": "Outlook 2016"}]}, "product_name": "Microsoft Outlook"}]}, "vendor_name": "Microsoft Corporation"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774", "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774", "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/101098", "name": "101098", "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1039542", "name": "1039542", "refsource": "SECTRACK"}, {"url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/", "name": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/", "refsource": "MISC"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\""}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Security Feature Bypass"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2017-11774", "STATE": "PUBLIC", "ASSIGNER": "secure@microsoft.com", "DATE_PUBLIC": "2017-10-10T00:00:00"}}}}, "cveMetadata": {"cveId": "CVE-2017-11774", "state": "PUBLISHED", "dateUpdated": "2025-02-10T19:34:51.719Z", "dateReserved": "2017-07-31T00:00:00.000Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2017-10-13T13:00:00.000Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{"cisaActionDue": "2022-05-03", "cisaExploitAdd": "2021-11-03", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Microsoft Office Outlook Security Feature Bypass Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:outlook:2010:sp2:*:*:*:*:*:*", "matchCriteriaId": "F9A115C1-45EB-4688-AD7C-C1854850EE9B", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:-:*:*:*", "matchCriteriaId": "8D513A61-6427-4F85-AADF-99D6F223AF2B", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:2013:sp1:*:*:rt:*:*:*", "matchCriteriaId": "DDA98A76-D0D1-4BFA-BEAC-1C2313F7B859", "vulnerable": true}, {"criteria": "cpe:2.3:a:microsoft:outlook:2016:*:*:*:*:*:*:*", "matchCriteriaId": "E2B1657C-0FF4-461A-BE2A-641275C4B0A0", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "Microsoft Outlook 2010 SP2, Outlook 2013 SP1 and RT SP1, and Outlook 2016 allow an attacker to execute arbitrary commands, due to how Microsoft Office handles objects in memory, aka \"Microsoft Outlook Security Feature Bypass Vulnerability.\""}, {"lang": "es", "value": "Microsoft Outlook 2010 SP2, Outlook 2013 SP1 y RT SP1 y Outlook 2016 permite a un atacante ejecutar comandos arbitrarios por la manera en la que Microsoft Office gestiona los objetos en la memoria. Esto tambi\u00e9n se conoce como \"Microsoft Outlook Security Feature Bypass Vulnerability\"."}], "id": "CVE-2017-11774", "lastModified": "2025-04-20T01:37:25.860", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "MEDIUM", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "PARTIAL", "baseScore": 6.8, "confidentialityImpact": "PARTIAL", "integrityImpact": "PARTIAL", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 6.4, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "LOCAL", "availabilityImpact": "HIGH", "baseScore": 7.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 1.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}, "published": "2017-10-13T13:29:00.427", "references": [{"source": "secure@microsoft.com", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/101098"}, {"source": "secure@microsoft.com", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039542"}, {"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774"}, {"source": "secure@microsoft.com", "tags": ["Exploit"], "url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/101098"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1039542"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-11774"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Exploit"], "url": "https://sensepost.com/blog/2017/outlook-home-page-another-ruler-vector/"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Deferred", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-119"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-119"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}