PT-2018-2284 · Microsoft · Outlook

Published 2018-11-13 · Updated 2020-08-24 · CVE-2018-8582

Positive Technologies (AI Summary)

CVSS v2.0

9.3

High

Base vector

AV:N/AC:M/Au:N/C:C/I:C/A:C

Name of the Vulnerable Software and Affected Versions Microsoft Outlook (affected versions not specified)

Description The issue is related to insufficient input validation in Microsoft Outlook, allowing a remote attacker to execute arbitrary code by using a specially crafted rule export file. This could enable the attacker to take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. Users with limited user rights on the system may be less affected than those operating with administrative rights.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2019-00408

CVE-2018-8582

Affected Products

Outlook

References · 6

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8582 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-8582 · Security Note
• https://osv.dev/vulnerability/CVE-2018-8582 · Vendor Advisory
• https://bdu.fstec.ru/vul/2019-00408 · Security Note
• http://securityfocus.com/bid/105825 · Note
• http://securitytracker.com/id/1042110 · Note