PT-2014-1211 · Microsoft · Web Applications

Publicado 2014-05-14 · Atualizado 2018-10-12 · CVE-2014-1813

Positive Technologies (AI Summary)

CVSS v2.0

8.5

Alta

Vetor base

AV:N/AC:M/Au:S/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Web Applications versions 2010 SP1 through 2010 SP2

Description The issue is related to errors occurring when working with the W3WP service, allowing an authenticated attacker to execute arbitrary code in the context of the W3WP service account security. This can be achieved by a remote authenticated user via crafted page content.

Recommendations For Microsoft Web Applications versions 2010 SP1 and 2010 SP2, update to a version that includes the fix for this issue to prevent exploitation. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Code Injection

Enumeração de Fraquezas

CWE-94

Identificadores relacionados

BDU:2014-00382

CVE-2014-1813

Produtos afetados

Web Applications

Referências · 6

• https://nvd.nist.gov/vuln/detail/CVE-2014-1813 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-022 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-1813 · Nota de Segurança
• http://securitytracker.com/id/1030227 · Nota
• https://bdu.fstec.ru/vul/2014-00382 · Nota de Segurança
• http://technet.microsoft.com/ru-ru/security/bulletin/ms14-022 · Nota