Office Web Apps
Vendor:
First CVE: Oct 13, 2010 · Active for 15 years
106
Total CVEs
More Total CVEs than 99% of tracked products
7.6
Avg CVEs / Year
Higher CVE frequency than 93% of tracked products
7.5
Avg CVSS
Higher Avg CVSS than 59% of tracked products
2.8%
KEV Rate
Higher KEV Rate than 96% of tracked products
Trends Over Time
The number and severity of CVEs published that impact Office Web Apps over time
Volume of CVEsAvg CVSS Base Score
First CVE
Oct 13, 2010
15 years ago
Most Recent CVE
Feb 14, 2023
1,256 days ago
CVE Severity & Scoring
Office Web Apps106 CVEs
21%
76%
All CVEs352,231 CVEs
45%
40%
11%
LowMediumHighCritical
Attack Vector
Local65 (61.3%)
Network18 (17.0%)
Unknown23 (21.7%)
Physical0 (0.0%)
Adjacent Network0 (0.0%)
Attack Complexity
Low82 (77.4%)
High1 (0.9%)
Unknown23 (21.7%)
User Interaction
None3 (2.8%)
Unknown23 (21.7%)
Required80 (75.5%)
Privileges Required
Low4 (3.8%)
High0 (0.0%)
None79 (74.5%)
Unknown23 (21.7%)
Top CVEs
Signals from CVEs in this product scope (106 CVEs).
106 CVEs · Highest risk first
| CVE | Published | CVSS | Risk | KEV | Exploit |
|---|---|---|---|---|---|
CVE-2014-1761HIGH Microsoft Word 2003 SP3, 2007 SP3, 2010 SP1 and SP2, 2013, and 2013 RT; Word Viewer; Office Compatibility Pack SP3; Office for Mac 2011; Word Automation Services on SharePoint Serv | Mar 25, 2014 | 7.8 | 96 | YES | YES |
CVE-2015-1641HIGH Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word 2013 SP1, Word 2013 RT SP1, Word for Mac 2011, Office Compatibility Pack SP3, Word Automation Services on SharePoint S | Apr 14, 2015 | 7.8 | 94 | YES | NO |
CVE-2012-2539HIGH Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; and Office Web Apps 2010 SP1 allow remote attackers to execute arbitrar | Dec 12, 2012 | 7.8 | 86 | YES | NO |
CVE-2023-21716CRITICAL Microsoft Word Remote Code Execution Vulnerability | Feb 14, 2023 | 9.8 | 77 | NO | NO |
CVE-2016-3357HIGH Microsoft Office 2007 SP3, Office 2010 SP2, Office 2013 SP1, Office 2013 RT SP1, Office 2016, Word for Mac 2011, Word 2016 for Mac, Word Viewer, Word Automation Services on SharePo | Sep 14, 2016 | 7.8 | 66 | NO | YES |
CVE-2011-1892MEDIUM Microsoft Office Groove 2007 SP2, SharePoint Workspace 2010 Gold and SP1, Office Forms Server 2007 SP2, Office SharePoint Server 2007 SP2, Office SharePoint Server 2010 Gold and SP | Sep 15, 2011 | 4.0 | 44 | NO | YES |
CVE-2010-3214HIGH Stack-based buffer overflow in Microsoft Word 2002 SP3, 2003 SP3, 2007 SP2, and 2010; Office 2004 and 2008 for Mac; Open XML File Format Converter for Mac; Office Compatibility Pac | Oct 13, 2010 | 9.3 | 41 | NO | NO |
CVE-2012-2528HIGH Use-after-free vulnerability in Microsoft Word 2003 SP3, 2007 SP2 and SP3, and 2010 SP1; Word Viewer; Office Compatibility Pack SP2 and SP3; Word Automation Services on Microsoft S | Oct 9, 2012 | 9.3 | 40 | NO | NO |
CVE-2015-1649HIGH Use-after-free vulnerability in Microsoft Word 2007 SP3, Office 2010 SP2, Word 2010 SP2, Word Viewer, Office Compatibility Pack SP3, Word Automation Services on SharePoint Server 2 | Apr 14, 2015 | 9.3 | 39 | NO | NO |
CVE-2018-0797HIGH Microsoft Office 2010, Microsoft Office 2013, and Microsoft Office 2016 allow a remote code execution vulnerability due to the way RTF content is handled, aka "Microsoft Word Memor | Jan 10, 2018 | 7.8 | 38 | NO | NO |
Exploit Exposure
Signals from CVEs in this product scope (106 CVEs).
CISA KEV
3 CVEs
2.8% of CVEs· 96th percentile
Metasploit
1 CVE
0.9% of CVEs· 96th percentile
Nuclei
0 CVEs
0.0% of CVEs· Bottom 1%
ExploitDB
3 CVEs
2.8% of CVEs· 88th percentile
Social Chatter
Signals from CVEs in this product scope (106 CVEs).
Media Mentions
Signals from CVEs in this product scope (106 CVEs).
Top CNAs Publishing CVEs For Office Web Apps
Top CWEs
Versions
| Version | CVE Count | Avg CVSS | Avg EPSS | KEV | Exploits |
|---|---|---|---|---|---|
| 2013 | 52 | 7.5 | 11.7% | 1 | 0 |
| 2010 | 75 | 7.4 | 20.6% | 3 | 3 |