CVE-2018-8174

Опубликовано: 09 мая 2018

Источник: nvd

CVSS3: 7.5

CVSS2: 7.6

EPSS Критический

Описание

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Ссылки

http://www.securityfocus.com/bid/103998
Third Party Advisory
VDB Entry
https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html
Exploit
Technical Description
Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/44741/
Exploit
Third Party Advisory
VDB Entry
http://www.securityfocus.com/bid/103998
Third Party Advisory
VDB Entry
https://blog.0patch.com/2018/05/a-single-instruction-micropatch-for.html
Exploit
Technical Description
Third Party Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8174
Patch
Vendor Advisory
https://www.exploit-db.com/exploits/44741/
Exploit
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_10_1607:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:-:sp2:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:*

cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:*

cpe:2.3:o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

EPSS

Процентиль: 100%

0.94283

Критический

7.5 High

CVSS3

7.6 High

CVSS2

Дефекты

CWE-787

Связанные уязвимости

CVE-2018-8174

CVSS3: 7.5

msrc

около 7 лет назад

Windows VBScript Engine Remote Code Execution Vulnerability

GHSA-5cv8-848m-hmm2

CVSS3: 7.5

github

около 3 лет назад

BDU:2018-00809

CVSS3: 7.5

fstec

около 7 лет назад

Уязвимость обработчика сценариев VBScript операционных систем Windows, позволяющая нарушителю выполнить произвольный код

EPSS

Процентиль: 100%

0.94283

Критический

7.5 High

CVSS3

7.6 High

CVSS2

Дефекты

CWE-787