CVE-2008-2463

Severity CVSS v4.0:

Pending analysis

Type:

CWE-94 Code Injection

Publication date:

07/07/2008

Last modified:

09/04/2025

Description

The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.

Impact

Vector 2.0

AV:N/AC:M/Au:N/C:P/I:P/A:P CVSS v2.0 Severity and Metrics:

Base Score: 6.80 MEDIUM
Vector: AV:N/AC:M/Au:N/C:P/I:P/A:P

Attack Vector (AV): Network
Attack Complexity (AC): Medium
Authentication (Au): None
Confidentiality (C): Physical
Integrity (I): Physical
Availability (A): Physical

Base Score 2.0

6.80

Severity 2.0

MEDIUM

Vulnerable products and versions

CPE	From	Up to
cpe:2.3:a:microsoft:office_snapshot_viewer_activex:office_2003:::::::*
cpe:2.3:a:microsoft:office_snapshot_viewer_activex:office_xp:::::::*
cpe:2.3:a:microsoft:office_snapshot_viewer_activex:office2000:::::::*

To consult the complete list of CPE names with products and versions, see this page

CVE-2008-2463

Description

Impact

Vulnerable products and versions

References to Advisories, Solutions, and Tools