PT-2018-9092 · Microsoft · Windows Server 2016+2

Published 2018-02-13 · Updated 2019-10-03 · CVE-2018-0828

Positive Technologies (AI Summary)

CVSS v3.1

7.8

High

Base vector

AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

Name of the Vulnerable Software and Affected Versions: Windows 10 version 1607 Windows Server 2016

Description: The issue is related to how the MultiPoint management account password is stored, allowing an elevation of privilege. This could potentially enable attackers to affect the system.

Recommendations: For Windows 10 version 1607, update the system to address the issue. For Windows Server 2016, apply the necessary patch to resolve the elevation of privilege vulnerability.

Fix

LPE

Insufficiently Protected Credentials

Weakness Enumeration

CWE-522

Related Identifiers

CVE-2018-0828

Affected Products

Windows

Windows 10

Windows Server 2016

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0828 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2018-0828 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-0828 · Security Note
• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2018-0828 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2018-0828 · Vendor Advisory
• http://securitytracker.com/id/1040373 · Note
• http://securityfocus.com/bid/102935 · Note