PT-2018-2051 · Microsoft · Office Word+3

Ben Faull · Published 2018-10-09 · Updated 2019-10-03 · CVE-2018-8504

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Word (affected versions not specified) Microsoft SharePoint Server (affected versions not specified) Office 365 ProPlus (affected versions not specified) Microsoft Office (affected versions not specified)

Description A remote code execution issue exists in Microsoft Word software when it fails to properly handle objects in Protected View. This could allow an attacker to run arbitrary code in the context of the current user. If the current user has administrative user rights, an attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Exploitation requires a user to open a specially crafted file with an affected version of Microsoft Office Word software.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-19

Related Identifiers

BDU:2019-00001

CVE-2018-8504

Affected Products

Office

Sharepoint Server

Office Word

Office 365 Proplus

References · 7

• https://bdu.fstec.ru/vul/2019-00001 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8504 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8504 · Vendor Advisory
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8504 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8504 · Security Note
• http://securitytracker.com/id/1041840 · Note
• http://securityfocus.com/bid/105499 · Note