CVE-2018-8247 Cross-site scripting in Microsoft Office
Attackers can exploit improper web request handling in Office Online Server to elevate privileges via cross-site scripting.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2018-8247?
CVE-2018-8247 is a medium-severity cross-site scripting vulnerability in Microsoft Office Online Server, published on 14 Jun 2018. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
An elevation of privilege vulnerability exists when Office Web Apps Server 2013 and Office Online Server fail to properly handle web requests, aka "Microsoft Office Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Office Online Server. This CVE ID is unique from CVE-2018-8245.
Weakness: CWE-79
Which versions are affected by CVE-2018-8247?
It affects 2 products.
Products include Microsoft Office Online Server, Microsoft Office Web Apps.
How do I fix CVE-2018-8247?
No fix has been published for CVE-2018-8247 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2018-8247 being exploited?
There is no known exploitation of CVE-2018-8247 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Office Online Server
- CVE-2022-33648 Microsoft Excel Remote Code Execution Vulnerability
- CVE-2017-8743 Memory corruption in Microsoft Office
- CVE-2023-23396 Microsoft Excel Denial of Service Vulnerability
- CVE-2020-1442 Cross-site scripting in Microsoft Office Online Server
- CVE-2022-30159 Microsoft Office Information Disclosure Vulnerability
Sources
Also known as GHSA-9635-5wrr-hhvf.