Vulnerability in Microsoft Access
CVE-2015-2503
Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office 2007 IME (Japanese) SP3, Access 2010 SP2, Excel 2010 SP2, InfoPath 2010 SP2, OneNote 2010 SP2, PowerPoint 2010 SP2, Project 2010 SP2, Publisher 2010 SP2, Visio 2010 SP2, Word 2010 SP2, Pinyin IME 2010, Access 2013 SP1, Excel 2013 SP1, InfoPath 2013 SP1, OneNote 2013 SP1, PowerPoint 2013 SP1, Project 2013 SP1, Publisher 2013 SP1, Visio 2013 SP1, Word 2013 SP1, Excel 2013 RT SP1, OneNote 2013 RT SP1, PowerPoint 2013 RT SP1, Word 2013 RT SP1, Access 2016, Excel 2016, OneNote 2016, PowerPoint 2016, Project 2016, Publisher 2016, Visio 2016, Word 2016, Skype for Business 2016, and Lync 2013 SP1 allow remote attackers to bypass a sandbox protection mechanism and gain privileges via a crafted web site that is accessed with Internet Explorer, as demonstrated by a transition from Low Integrity to Medium Integrity, aka "Microsoft Office Elevation of Privilege Vulnerability."
Published · last modified .
CVSS v2 metric
CVSS v2 base score 9.3 (High). Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.165 (97.0th percentile), scored .
Moderate probability of exploitation in the next 30 days — watch for active exploitation reports. 97th percentile — 97.0% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.165 · newest: 0.165 · change: 0.000
Affected products
- Microsoft Access — versions 2007, 2010, 2013
- Microsoft Excel — versions 2007, 2010, 2013
- Microsoft Infopath — versions 2007, 2010, 2013
- Microsoft Lync — versions 2013
- Microsoft Office 2007 Ime — versions sp3
- Microsoft Onenote — versions 2007, 2010, 2013
- Microsoft Pinyin Ime — versions 2010
- Microsoft Powerpoint — versions 2007, 2010, 2013
- Microsoft Project — versions 2007, 2016
- Microsoft Project Server — versions 2010, 2013
Weakness classification (CWE)
Public proof-of-concept exploits
References
- www.securitytracker.com/id/1034117 (VDB Entry, Third Party Advisory, vdb-entry)
- www.securitytracker.com/id/1034122 (VDB Entry, Third Party Advisory, vdb-entry)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-116 (vendor-advisory)
- www.securitytracker.com/id/1034119 (VDB Entry, Third Party Advisory, vdb-entry)
Frequently asked questions
- What is CVE-2015-2503?
- CVE-2015-2503 is a vulnerability in Microsoft Access, classified under CWE-264. Published 2015-11-11.
- Is CVE-2015-2503 known to be exploited?
- 1 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.