CVE-2008-2463
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed...
CVE-2008-2463 is a medium vulnerability (CVSS 6.8) in Microsoft Office Snapshot Viewer Activex, published July 7, 2008. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 59.0%, the 99th percentile. No source names a fixed version.
- Severity
- 6.8 MediumCVSS 2.0, NVD
- Exploit chance
- 59.0%EPSS, 99th percentile
- Exploitation
- None known3 public exploits
- Fixed in
- No fix listedNo source names one
Description
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
Exploit likelihood
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Metasploit | Snapshot Viewer for Microsoft Access ActiveX Control Arbitrary File Download | 2008-07-07 |
| Exploit-DB | Microsoft Access - 'Snapview.ocx 10.0.5529.0' ActiveX Remote File Download | 2008-07-24 |
| Exploit-DB | Snapshot Viewer for Microsoft Access - ActiveX Control Arbitrary File Download (Metasploit) | 2010-09-20 |
What each source reports
NVD Score used
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
CVE-2008-2463- CVSS 2.0
- 6.8 Medium
AV:N/AC:M/Au:N/C:P/I:P/A:P - Weakness
- CWE-94
- Updated
- 2026-11-02
CVE ListNo score
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
CVE-2008-2463- Updated
- 2026-11-02
EUVDEUVD-2008-2458No score
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
EUVD-2008-2458- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-frx4-jc3x-7q59No score
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed...
The Microsoft Office Snapshot Viewer ActiveX control in snapview.ocx 10.0.5529.0, as distributed in the standalone Snapshot Viewer and Microsoft Office Access 2000 through 2003, allows remote attackers to download arbitrary files to a client machine via a crafted HTML document or e-mail message, probably involving use of the SnapshotPath and CompressedPath properties and the PrintSnapshot method. NOTE: this can be leveraged for code execution by writing to a Startup folder.
- Record
GHSA-frx4-jc3x-7q59- Weakness
- CWE-94
- Updated
- 2026-11-02
History
| Recorded | Changed | Sources |
|---|---|---|
| exploits, facts | ||
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, Metasploit, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
References
us-cert.gov/cas/techalerts/TA08-189A.html
exploit-db.com/exploits/6124
vupen.com/english/advisories/2008/2012/references
marc.info?l=bugtraq&m=121915960406986&w=2
microsoft.com/technet/security/advisory/955179.mspx
Show 8 moreShow less
kb.cert.org/vuls/id/837785
secunia.com/advisories/30883
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6120
exchange.xforce.ibmcloud.com/vulnerabilities/43613
securityfocus.com/bid/30114
securitytracker.com/id?1020433
nvd.nist.gov/vuln/detail/CVE-2008-2463
github.com/advisories/GHSA-frx4-jc3x-7q59