Read the docs
TI-2017-08815 Aliases CVE-2017-11876GHSA-hc3g-h2rv-xpmc

Cross-site request forgery in Microsoft Server

Priority MEDIUM 43CWE-352Published · Updated

Key facts

Attack vector
Network
Privileges required
None
User interaction
Required
Attack complexity
Low
Impact type
Tampering
Confidentiality · integrity · availability
High · High · High
Fix status
No fix listed

Attack profile from CVSS 3.0 · NVD. Fix status from CNA. Impact type from CWE-352.

Summary

Microsoft Project Server and Microsoft SharePoint Enterprise Server 2016 allow an attacker to use cross-site forgery to read content that they are not authorized to read, use the victim's identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim, aka "Microsoft Project Server Elevation of Privilege Vulnerability".

Why it matters now

EPSS 0.02474 84th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet

SSVC decision points

Not available: CISA has not published SSVC decision points for this record.

Affected products

VendorProductAffected versionsFixed inStatusSource
MicrosoftMicrosoft ServerMicrosoft Project Server 2013, Microsoft SharePoint Enterprise Server 2016—No fix listedCNA
  • Microsoft Server VendorMicrosoft Affected Microsoft Project Server 2013, Microsoft SharePoint Enterprise Server 2016 Fixed in — No fix listed CNA

CPE configurations NVD · 2

CPEVersionsRoleVendor
cpe:2.3:a:microsoft:project_server:2013:sp1:*:*:*:*:*:*2013 sp1VulnerableMicrosoft
cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:*2016VulnerableMicrosoft
  • cpe:2.3:a:microsoft:project_server:2013:sp1:*:*:*:*:*:* Versions 2013 sp1 Vulnerable ·Microsoft
  • cpe:2.3:a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* Versions 2016 Vulnerable ·Microsoft

Remediation

No fixed version listed by the sources yet.

Timeline

  1. 2026-10-02 Threatist record created from CVE-2017-11876
  2. 2026-10-03 Alias added: GHSA-hc3g-h2rv-xpmc

References

Patch 1

  • TI-2018-05989 Code injection in Microsoft .NET Framework CVSS 3.0HIGH 8.1
  • TI-2009-00094 Microsoft Project 2000 SR1 and 2002 SP1, and Office Project 2003 SP3, does not properly… CVSS 2.0HIGH 9.3
  • TI-2015-02200 Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3… CVSS 2.0HIGH 9.3
  • TI-2014-00243 Microsoft Windows SharePoint Services 3.0 SP3; SharePoint Server 2007 SP3, 2010 SP1 and… CVSS 2.0HIGH 9.0
  • TI-2017-00256 Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2016, Office Online… CVSS 3.0HIGH 7.8
  • TI-2006-06361 projectserver/logon/pdsrequest.asp in Microsoft Project Server 2003 allows remote… CVSS 2.0MEDIUM 6.5
See all 23 →

Sources

This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences