PT-2018-2600 · Microsoft · Windows Server 2016+12

Guyio

·

Published

2018-10-09

·

Updated

2018-11-28

·

CVE-2018-8494

CVSS v2.0

9.3

High

VectorAV:N/AC:M/Au:N/C:C/I:C/A:C
Name of the Vulnerable Software and Affected Versions Microsoft XML Core Services versions prior to the fixed version Windows 7 Windows Server 2012 R2 Windows RT 8.1 Windows Server 2008 Windows Server 2019 Windows Server 2012 Windows 8.1 Windows Server 2016 Windows Server 2008 R2 Windows 10 Windows 10 Servers
Description The issue is related to the incorrect restriction of XML links to external objects in Microsoft XML Core Services. This can be exploited by a remote attacker using a specially crafted web page, potentially allowing the execution of arbitrary code. The vulnerability affects various Windows operating systems and can be exploited remotely.
Recommendations For Windows 7, consider applying the relevant security patch to fix the issue. For Windows Server 2012 R2, apply the security update to resolve the vulnerability. For Windows RT 8.1, install the latest security patch to mitigate the risk. For Windows Server 2008, apply the recommended fix to address the issue. For Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, and Windows 10 Servers, update to the latest version or apply the relevant security patch to fix the vulnerability. As a temporary workaround, consider restricting the use of the MSXML parser until a patch is available.

Fix

RCE

XXE

Found an issue in the description? Have something to add? Feel free to write us 👾

Weakness Enumeration

Related Identifiers

BDU:2019-01088
CVE-2018-8494

Affected Products

Xml Core Services
Windows
Windows 10
Windows 10 Servers
Windows 7
Windows 8.1
Windows Rt 8.1
Windows Server 2008
Windows Server 2008 R2
Windows Server 2012
Windows Server 2012 R2
Windows Server 2016
Windows Server 2019