Description
Microsoft Office Excel 2007 Gold and SP1 does not properly delete the PWD (password) string from connections.xml when a .xlsx file is configured not to save the remote data session password, which allows local users to obtain sensitive information and obtain access to a remote data source, aka the "Excel Credential Caching Vulnerability."
References
- TA08-225A third-party-advisory
- 30641 vdb-entry
- HPSBST02360 vendor-advisory
- MS08-043 vendor-advisory
- 1020669 vdb-entry
- oval:org.mitre.oval:def:5951 vdb-entry signature
- 31454 third-party-advisory
- ADV-2008-2347 vdb-entry