CVE-2015-0097

EPSS 40.9%

Vexday Risk Score

35Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 40.9%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Lifecycle

11 Mar 2015Published on NVD

20 Jul 2015Public PoC

Weaponization speed

131 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Microsoft Excel 2007 SP3, PowerPoint 2007 SP3, Word 2007 SP3, Excel 2010 SP2, PowerPoint 2010 SP2, and Word 2010 SP2 allow remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Word Local Zone Remote Code Execution Vulnerability."

Affected products

n/a · n/a

public PoCs found — 2

exploitdbwww.exploit-db.com/exploits/37657unverified cve_referencewww.exploit-db.com/exploits/37657/unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-022 https://www.exploit-db.com/exploits/37657/http://www.securitytracker.com/id/1031896