9.3

CVE-2009-0238

Microsoft Office Excel 2000 SP3, 2002 SP3, 2003 SP3, and 2007 SP1; Excel Viewer 2003 Gold and SP3; Excel Viewer; Compatibility Pack for Word, Excel, and PowerPoint 2007 File Formats SP1; and Excel in Microsoft Office 2004 and 2008 for Mac allow remote attackers to execute arbitrary code via a crafted Excel document that triggers an access attempt on an invalid object, as exploited in the wild in February 2009 by Trojan.Mdropper.AC.

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Excel Version2004 Editionmac
Microsoft ≫ Office Version2008 Editionmac
Microsoft ≫ Office Compatibility Pack Version2007 Updatesp1
Microsoft ≫ Office Excel Version2000 Updatesp3
Microsoft ≫ Office Excel Version2002 Updatesp3
Microsoft ≫ Office Excel Version2003 Updatesp3
Microsoft ≫ Office Excel Version2007 Updatesp1
Microsoft ≫ Office Excel Viewer Version2003 Updategold
Microsoft ≫ Office Excel Viewer Version2003 Updatesp3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 57.18% 0.981
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C
CWE-94 Improper Control of Generation of Code ('Code Injection')

The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.