CVE-2017-0045 describes a Cross-Site Request Forgery (CSRF) vulnerability in Windows DVD Maker, affecting Windows 7 SP1, Windows Server 2008 SP2 and R2 SP1, and Windows Vista SP2. This flaw allows attackers to obtain sensitive information by tricking a user into opening a specially crafted .msdvd file. With a CVSS score of 5.5 (Medium), it requires user interaction (UI:R) and local access (AV:L) to exploit, potentially leading to information disclosure (C:H). While not actively exploited in the wild and absent from the KEV catalog, an XML External Entity Injection exploit (EDB-41619) exists, though there is no evidence of widespread community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_7:*:sp1:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* | ||
r2CPE matchmatch criteria | cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* | ||
All Versions ImpactedCPE matchmatch criteria | cpe:2.3:o:microsoft:windows_vista:*:sp2:*:*:*:*:*:* |
CVSS version used by this source: 3.0
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.1 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.1 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.