PT-2017-18489 · Microsoft · Windows Server 2008 R2+4

Published 2017-09-12 · Updated 2025-03-23 · CVE-2017-8710

Positive Technologies (AI Summary)

CVSS v3.1

5.5

Medium

Base vector

AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Windows 7 SP1 Windows Server 2008 SP2 Windows Server 2008 R2 SP1

Description The issue allows an attacker to read arbitrary files via an XML external entity (XXE) declaration, due to the way that the Microsoft Common Console Document (.msc) parses XML input containing a reference to an external entity. This can enable attackers to obtain sensitive information and affect the system.

Recommendations For Microsoft Windows 7 SP1, update to a version that includes the fix for this issue. For Windows Server 2008 SP2, update to a version that includes the fix for this issue. For Windows Server 2008 R2 SP1, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to the Microsoft Common Console Document (.msc) to minimize the risk of exploitation.

Exploit

Fix

XXE

Weakness Enumeration

CWE-611

Related Identifiers

CVE-2017-8710

Affected Products

Common Console Document

Windows 7 Sp1

Windows

Windows Server 2008 R2 Sp1

Windows Server 2008 R2

References · 10

• 🔥 https://youtube.com/watch?v=bIFot3a-58I · Exploit
• 🔥 https://vulnerability-lab.com/get_content.php?id=2094 · Exploit
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8710 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8710 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8710 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8710 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2017-8710 · Vendor Advisory
• http://securitytracker.com/id/1039325 · Note
• https://twitter.com/hyp3rlinx/status/1903604280105242647 · Twitter Post
• http://securityfocus.com/bid/100793 · Note