jvndb-2015-000112
Vulnerability from jvndb
Published
2015-08-12 15:13
Modified
2015-08-12 15:13
Severity ?
() - -
Summary
Microsoft Office discloses a file path of a local file
Details
When a file such as a clipart or an image is inserted in Office documents, the absolute path of the local file is stored in "alternative text". Yosuke HASEGAWA of SecureSky Technology Inc. and Miyuki Chikara of MARUS JAPAN Inc. reported this vulnerability to IPA. JPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.
Impacted products
Show details on JVN DB website


{
  "@rdf:about": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000112.html",
  "dc:date": "2015-08-12T15:13+09:00",
  "dcterms:issued": "2015-08-12T15:13+09:00",
  "dcterms:modified": "2015-08-12T15:13+09:00",
  "description": "When a file such as a clipart or an image is inserted in Office documents, the absolute path of the local file is stored in \"alternative text\".\r\n\r\nYosuke HASEGAWA of SecureSky Technology Inc. and Miyuki Chikara of MARUS JAPAN Inc. reported this vulnerability to IPA.\r\nJPCERT/CC coordinated with the developer under Information Security Early Warning Partnership.",
  "link": "https://jvndb.jvn.jp/en/contents/2015/JVNDB-2015-000112.html",
  "sec:cpe": {
    "#text": "cpe:/a:microsoft:office",
    "@product": "Microsoft Office",
    "@vendor": "Microsoft Corporation",
    "@version": "2.2"
  },
  "sec:cvss": {
    "@score": "4.3",
    "@severity": "Medium",
    "@type": "Base",
    "@vector": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
    "@version": "2.0"
  },
  "sec:identifier": "JVNDB-2015-000112",
  "sec:references": [
    {
      "#text": "http://jvn.jp/en/jp/JVN20459920/index.html",
      "@id": "JVN#20459920",
      "@source": "JVN"
    },
    {
      "#text": "https://www.ipa.go.jp/en/security/vulnerabilities/cwe.html",
      "@id": "CWE-200",
      "@title": "Information Exposure(CWE-200)"
    }
  ],
  "title": "Microsoft Office discloses a file path of a local file"
}


Log in or create an account to share your comment.




Tags
Taxonomy of the tags.


Loading...

Loading...

Loading...

Sightings

Author Source Type Date

Nomenclature

  • Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
  • Confirmed: The vulnerability is confirmed from an analyst perspective.
  • Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
  • Patched: This vulnerability was successfully patched by the user reporting the sighting.
  • Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
  • Not confirmed: The user expresses doubt about the veracity of the vulnerability.
  • Not patched: This vulnerability was not successfully patched by the user reporting the sighting.