CVE-2017-0022

medium Microsoft ⚠️ CISA KEV — Exploited in the Wild
CVSS v3 Base Score
6.5
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
EPSS Score
44.1%
Exploitation probability in 30 days
Top 2% most likely to be exploited
Attack Characteristics
Attack Vector
Network
Attack Complexity
Low
Privileges Required
None
User Interaction
Required
Confidentiality
High
Integrity
None
Availability
None
Published: March 17, 2017 (3346 days ago)
Last Modified: April 22, 2026
Vendor: Microsoft
Source: NVD

⚠️ CISA Known Exploited Vulnerability

Added to KEV: 2022-05-24
Remediation Due: 2022-06-14 (⚠ 1431d overdue)

Description

Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka "Microsoft XML Information Disclosure Vulnerability."

CWE

CWE-119

Affected Products

microsoft xml core servicesmicrosoft windows 8.1microsoft windows server 2008microsoft windows server 2012

References

🔗 www.securityfocus.com 🔗 www.securitytracker.com 🔗 0patch.blogspot.com 🔗 portal.msrc.microsoft.com 🔗 www.securityfocus.com