CVE-2008-3003 Information disclosure in n/a
Local attackers can extract cached remote data source passwords from Excel files, enabling unauthorized access to remote data sources.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Local or same network only
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2008-3003?
CVE-2008-3003 is a medium-severity vulnerability in Microsoft Office, published on 12 Aug 2008. It can only be exploited from the same machine or local network, and only if a user opens a file or follows a link.
Official description
Microsoft Office Excel 2007 Gold and SP1 does not properly delete the PWD (password) string from connections.xml when a .xlsx file is configured not to save the remote data session password, which allows local users to obtain sensitive information and obtain access to a remote data source, aka the "Excel Credential Caching Vulnerability."
Weakness: CWE-20
Which versions are affected by CVE-2008-3003?
It affects 1 product.
Products include Microsoft Office.
How do I fix CVE-2008-3003?
No fix has been published for CVE-2008-3003 yet. Limit exposure of the affected software until one is available.
Is CVE-2008-3003 being exploited?
There is no known exploitation of CVE-2008-3003 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Office
Sources
Also known as GHSA-6x7h-634p-8jfg.