CVE-2018-8544

Exploit

EPSS 47.56%
Veröffentlicht 14.11.2018 01:29:00
Zuletzt bearbeitet 21.11.2024 04:14:00
Erkennungen
Login

A remote code execution vulnerability exists in the way that the VBScript engine handles objects in memory, aka "Windows VBScript Engine Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Betroffene Produkte Warnungen 0 Metriken 3 CWE 1 Referenzen 7

NVD 17 VulnDex Vulnerability Enrichment 0

Daten sind bereitgestellt durch National Vulnerability Database (NVD)

Microsoft ≫ Windows 10 Version -

Microsoft ≫ Windows 10 Version 1607

Microsoft ≫ Windows 10 Version 1703

Microsoft ≫ Windows 10 Version 1709

Microsoft ≫ Windows 10 Version 1803

Microsoft ≫ Windows 10 Version 1809

Microsoft ≫ Windows 7 Version - Update sp1

Microsoft ≫ Windows 8.1 Version -

Microsoft ≫ Windows Rt 8.1 Version -

Microsoft ≫ Windows Server 2008 Version - Update sp2

Microsoft ≫ Windows Server 2008 Version r2 Update sp1 HwPlatform itanium

Microsoft ≫ Windows Server 2012 Version -

Microsoft ≫ Windows Server 2012 Version r2

Microsoft ≫ Windows Server 2016 Version -

Microsoft ≫ Windows Server 2016 Version 1709

Microsoft ≫ Windows Server 2016 Version 1803

Microsoft ≫ Windows Server 2019 Version -

Zu dieser CVE wurde keine Warnung gefunden.

EPSS Metriken
Typ	Quelle	Score	Percentile
EPSS	FIRST.org	47.56%	0.987

CVSS Metriken
Quelle	Base Score	Exploit Score	Impact Score	Vector String
NIST	8.8	2.8	5.9	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
NIST	9.3	8.6	10	AV:N/AC:M/Au:N/C:C/I:C/A:C

CWE-416 Use After Free

The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.

http://www.securityfocus.com/bid/105787

Third Party Advisory

VDB Entry

http://www.securitytracker.com/id/1042118

Third Party Advisory

VDB Entry

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8544

Patch

Vendor Advisory

https://www.exploit-db.com/exploits/45923/

Third Party Advisory

Exploit

VDB Entry

https://nvd.nist.gov/vuln/detail/CVE-2018-8544

CVE Source (NVD)

https://cveawg.mitre.org/api/cve/CVE-2018-8544

CVE Source (JSON)

https://euvd.enisa.europa.eu/vulnerability/CVE-2018-8544

EUVD

Team-orientierte Vulnerability Management Plattform

Features der Plattform

CVE-2018-8544