Product:
Office Out-of-Box Experience
Summary
Improper neutralization of input during web page generation allows an unauthorized attacker to perform spoofing over a network. This vulnerability can lead to significant security risks, including unauthorized access and data manipulation. It is crucial for users to be aware of this issue to protect their systems.
Details
| Severity | Base Score | CVE |
|---|---|---|
| HIGH | 8.2 | CVE-2025-64677 |
Exploitation
An attacker can exploit this vulnerability by crafting a malicious web page that takes advantage of the improper input handling in the Office Out-of-Box Experience. When a user interacts with the compromised page, the attacker can execute scripts in the context of the user’s session, potentially leading to data theft or unauthorized actions.
Affected Products
- Office Out-of-Box Experience: Vulnerable to cross-site scripting attacks due to improper input handling.
Mitigation
To mitigate this vulnerability, users should ensure that they are using the latest version of the Office Out-of-Box Experience and apply any available security updates. Additionally, implementing web application firewalls and input validation can help reduce the risk of exploitation.