PT-2017-18489 · Microsoft · Windows Server 2008 R2+4

Publicado 2017-09-12 · Atualizado 2025-03-23 · CVE-2017-8710

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Média

Vetor base

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows 7 SP1 Windows Server 2008 SP2 Windows Server 2008 R2 SP1

Description The issue allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity. This can enable attackers to obtain sensitive information and affect the system.

Recommendations For Microsoft Windows 7 SP1, update to a version that includes the fix for this issue. For Windows Server 2008 SP2, update to a version that includes the fix for this issue. For Windows Server 2008 R2 SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Microsoft Common Console Document (.msc) to minimize the risk of exploitation.

Exploit

Correção

XXE

Enumeração de Fraquezas

CWE-611

Identificadores relacionados

CVE-2017-8710

Produtos afetados

Common Console Document

Windows 7 Sp1

Windows

Windows Server 2008 R2 Sp1

Windows Server 2008 R2

Referências · 10

• 🔥 https://youtube.com/watch?v=bIFot3a-58I · Exploit
• 🔥 https://vulnerability-lab.com/get_content.php?id=2094 · Exploit
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8710 · Aviso do Fabricante
• http://securitytracker.com/id/1039325 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2017-8710 · Nota de Segurança
• https://twitter.com/hyp3rlinx/status/1903604280105242647 · Publicação no Twitter
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8710 · Nota de Segurança
• http://securityfocus.com/bid/100793 · Nota
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8710 · Aviso do Fabricante
• https://osv.dev/vulnerability/CVE-2017-8710 · Aviso do Fabricante