{"id":"CVE-2017-0022","kind":"vulnerability","aliases":["CVE-2017-0022"],"related":[],"title":"Microsoft XML Core Services: Microsoft XML Core Services Information Disclosure Vulnerability","description":"Microsoft XML Core Services (MSXML) in Windows 10 Gold, 1511, and 1607; Windows 7 SP1; Windows 8.1; Windows RT 8.1; Windows Server 2008 SP2 and R2 SP1; Windows Server 2012 Gold and R2; Windows Server 2016; and Windows Vista SP2 improperly handles objects in memory, allowing attackers to test for files on disk via a crafted web site, aka \"Microsoft XML Information Disclosure Vulnerability.\"","summary":"Microsoft XML Core Services (MSXML) mishandles objects in memory, letting a crafted web page test whether files exist on the victim's disk. The attacker gets file-existence information, not file contents.","severity":"medium","cvss":6.5,"epss":0.18069,"exploited":true,"exploited_at":"2022-05-24T00:00:00+00:00","products":[{"name":"Microsoft XML Core Services","fixed":[],"affected":"","ecosystem":"vendor"}],"ecosystems":["vendor"],"tags":["exploited","infrastructure","internet-explorer","msxml","windows"],"not_affected_if":["patched-windows"],"how_to_check":null,"fix":"Apply the Microsoft security update for MSXML per vendor instructions, as CISA requires.","status":"open","published_at":"2017-03-17T00:59:00+00:00","first_seen_at":"2026-10-23T19:11:52+00:00","triaged_at":"2026-10-23T21:15:53+00:00","updated_at":"2026-10-23T21:57:35+00:00","category":"infrastructure","confidence":0.6,"triage":{"at":"2026-10-23T21:15:53Z","model":"claude-haiku-5-5","output":{"fix":"Apply the Microsoft security update for MSXML per vendor instructions, as CISA requires.","reach":"internet","impact":"low","summary":"Microsoft XML Core Services (MSXML) mishandles objects in memory, letting a crafted web page test whether files exist on the victim's disk. The attacker gets file-existence information, not file contents.","category":"infrastructure","who_cares":["windows","msxml","internet-explorer"],"confidence":0.6,"needs_auth":"no","worst_case":"Attacker learns which files exist on the victim's disk","analyst_note":"Confirm the affected MSXML versions and the Microsoft bulletin/KB for this CVE (sources list no fixed versions) and whether it needs a browser to load the page.","how_to_check":"unknown","needs_analyst":true,"not_affected_if":["patched-windows"],"user_interaction":"yes","needs_special_setup":"unknown","severity_if_unknown":"low"},"cost_usd":0.00045,"input_tokens":2835,"output_tokens":334,"severity_before":"unknown"},"analyst_status":null,"analyst_note":null,"search":"'-0022':14A,17A '-2017':13A,16A '10':69C '1511':71C '1607':73C '2008':84C '2012':91C '2016':97C '7':75C '8.1':78C,81C 'aka':120C 'allow':107C 'attack':53B,108C 'content':61B 'core':3A,7A,20A,31B,64C 'craft':40B,117C 'cve':12A,15A 'disclosur':10A,124C 'disk':51B,114C 'exist':46B,57B 'exploit':22B 'explor':26B 'file':45B,56B,60B,112C 'file-exist':55B 'get':54B 'gold':70C,92C 'handl':103C 'improp':102C 'inform':9A,58B,123C 'infrastructur':23B 'internet':25B 'internet-explor':24B 'let':38B 'memori':37B,106C 'microsoft':1A,5A,18A,29B,62C,121C 'mishandl':34B 'msxml':27B,33B,66C 'object':35B,104C 'page':42B 'r2':87C,94C 'rt':80C 'server':83C,90C,96C 'servic':4A,8A,32B,65C 'services':21A 'site':119C 'sp1':76C,88C 'sp2':85C,101C 'test':43B,110C 'via':115C 'victim':49B 'vista':100C 'vulner':11A,125C 'web':41B,118C 'whether':44B 'window':28B,68C,74C,77C,79C,82C,89C,95C,99C 'xml':2A,6A,19A,30B,63C,122C","nicknames":[],"mitigations":[],"who_affected":null,"tier":null,"verified":{},"analyst_revisit_at":null,"first_public_at":"2017-03-17T00:59:00+00:00","kev":{"dateAdded":"2022-05-24","dueDate":"2022-06-14","requiredAction":"Apply updates per vendor instructions.","knownRansomwareCampaignUse":"Unknown"},"cvss_vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N","cvss_by":"nvd@nist.gov","poc_count":0,"sources":[{"source":"kev","external_id":"CVE-2017-0022","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?search_api_fulltext=CVE-2017-0022","severity":null,"published_at":"2022-05-24T00:00:00+00:00","modified_at":null,"first_seen_at":"2026-10-23T19:11:52+00:00","fetched_at":"2026-10-25T16:39:48+00:00","note":null},{"source":"epss","external_id":"CVE-2017-0022","url":"https://api.first.org/data/v1/epss?cve=CVE-2017-0022","severity":null,"published_at":null,"modified_at":null,"first_seen_at":"2026-10-23T19:13:45+00:00","fetched_at":"2026-10-23T19:13:45+00:00","note":null},{"source":"nvd","external_id":"CVE-2017-0022","url":"https://nvd.nist.gov/vuln/detail/CVE-2017-0022","severity":null,"published_at":"2017-03-17T00:59:00+00:00","modified_at":"2026-06-17T00:56:56+00:00","first_seen_at":"2026-10-23T21:57:35+00:00","fetched_at":"2026-10-23T21:57:35+00:00","note":null}],"documents":[],"notice":"Free to read at a human pace. An API with keys and an MCP server are in preparation; early access: hello@infrastack.ai"}