« Volver al listado

CVE-2017-0295

Estado: ModificadaMedia (5.5)—

Microsoft Windows 10 1607 y 1703 y Windows Server 2016 permiten a un atacante autenticado modificar la estructura de carpetas C:\Users\DEFAULT, también conocida como "Vulnerabilidad de manipulación de carpetas predeterminada de Windows".

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — Windows 10Microsoft — Windows Server 2016

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2017-0295",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 2.1,
          "accessVector": "LOCAL",
          "vectorString": "AV:L/AC:L/Au:N/C:N/I:P/A:N",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "NONE"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "LOW",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 3.9,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 5.5,
          "attackVector": "LOCAL",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:N/I:H/A:N",
          "integrityImpact": "HIGH",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "NONE"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft Corporation",
          "product": "Microsoft Windows",
          "versions": [
            {
              "status": "affected",
              "version": "Microsoft Windows 10 1607 and 1703, and Windows Server 2016."
            }
          ]
        }
      ]
    }
  ],
  "published": "2017-06-15T01:29:02.240",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/98904",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1038674",
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0295",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/98904",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1038674",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0295",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "Microsoft Windows 10 1607 and 1703, and Windows Server 2016 allow an authenticated attacker to modify the C:\\Users\\DEFAULT folder structure, aka \"Windows Default Folder Tampering Vulnerability\"."
    },
    {
      "lang": "es",
      "value": "Microsoft Windows 10 1607 y 1703 y Windows Server 2016 permiten a un atacante autenticado modificar la estructura de carpetas C:\\Users\\DEFAULT, también conocida como \"Vulnerabilidad de manipulación de carpetas predeterminada de Windows\"."
    }
  ],
  "lastModified": "2026-06-17T00:57:27.167",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E01A4CCA-4C43-46E0-90E6-3E4DBFBACD64"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AEE2E768-0F45-46E1-B6D7-087917109D98"
            },
            {
              "criteria": "cpe:2.3:o:microsoft:windows_server_2016:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "AF6437F9-6631-49D3-A6C2-62329E278E31"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}