{
  "cveId": "CVE-2017-11876",
  "url": "https://patchblox.com/security/cve/CVE-2017-11876",
  "summary": "CVE-2017-11876 is fixed in 2 products on 1 platform, first by KB4011257, released November 14, 2017. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Microsoft Project Server Elevation of Privilege Vulnerability",
  "description": "\u003Cp\u003EAn elevation of privilege vulnerability exists in Microsoft Project when Microsoft Project Server does not properly manage user sessions. For this \u003Ca href=\u0022https://technet.microsoft.com/en-us/library/security/dn848375.aspx#CSRF\u0022\u003ECross-site Request Forgery(CSRF/XSRF)\u003C/a\u003E vulnerability to be exploited, the victim must be authenticated to (logged on) the target site.\u003C/p\u003E\n\u003Cp\u003EIn a web-based attack scenario an attacker could host a website (or leverage a compromised website that accepts or hosts user-provided content) that contains a specially crafted webpage that is designed to exploit the vulnerability. An attacker would have no way to force users to visit the website. Instead, an attacker would have to convince users to click a link, typically by way of an enticement in an email or Instant Messenger message. An attacker who successfully exploited this vulnerability could read content that the attacker is not authorized to read, use the victim\u0027s identity to take actions on the web application on behalf of the victim, such as change permissions and delete content, and inject malicious content in the browser of the victim.\u003C/p\u003E\n\u003Cp\u003EThe update addresses the vulnerability by modifying how Microsoft Project Server manages user session authentication.\u003C/p\u003E",
  "published": "2017-11-14T08:00:00Z",
  "severity": "Moderate",
  "epss": 0.02474,
  "epssPercentile": 0.84605,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": false,
  "exploitabilityAssessment": "Exploitation Unlikely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-11876",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Project Server 2013 Service Pack 1 (64-bit edition)",
      "fixedVersion": "",
      "fix": "KB4011257",
      "url": "https://patchblox.com/security/fix/microsoft/kb4011257",
      "released": "2017-11-14T08:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft SharePoint Enterprise Server 2016",
      "fixedVersion": "",
      "fix": "KB4011244",
      "url": "https://patchblox.com/security/fix/microsoft/kb4011244",
      "released": "2017-11-14T08:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T12:40:37Z"
}