PT-2018-2051 · Microsoft · Office Word+3

Ben Faull · Publicado 2018-10-09 · Atualizado 2019-10-03 · CVE-2018-8504

Positive Technologies (AI Summary)

CVSS v2.0

9.3

Alta

Vetor base

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word (affected versions not specified) Microsoft SharePoint Server (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified)

Description A remote code execution issue exists in Microsoft Word software when it fails to properly handle objects in Protected View. This could allow an attacker to run arbitrary code in the context of the current user. If the current user has administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office Word software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Enumeração de Fraquezas

CWE-19

Identificadores relacionados

BDU:2019-00001

CVE-2018-8504

Produtos afetados

Office

Sharepoint Server

Office Word

Office 365 Proplus

Referências · 7

• https://bdu.fstec.ru/vul/2019-00001 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8504 · Nota de Segurança
• http://securitytracker.com/id/1041840 · Nota
• https://osv.dev/vulnerability/CVE-2018-8504 · Aviso do Fabricante
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8504 · Aviso do Fabricante
• http://securityfocus.com/bid/105499 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2018-8504 · Nota de Segurança