CVE-2018-8420

HIGH severity · CVSS 8.8 · XML external entity (XXE)

8.8CVSS HIGH

Summary

A remote code execution vulnerability exists when the Microsoft XML Core Services MSXML parser processes user input, aka "MS XML Remote Code Execution Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Impact & exploitability

Attack vectorNetwork

Attack complexityLow

Privileges requiredNone

User interactionRequired

Confidentiality impactHigh

Integrity impactHigh

Availability impactHigh

Exploit probability (EPSS)53%

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Affected products we track (2)

Windows Server Windows 10

Recommendation

Apply the vendor fix promptly. Open any affected product above for its exact safe version.

Official patch: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8420 ↗

Additional information

NVD record
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8420Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8420Patch
http://www.securityfocus.com/bid/105259Advisory
http://www.securitytracker.com/id/1041627Advisory
http://www.securityfocus.com/bid/105259Advisory
http://www.securitytracker.com/id/1041627Advisory