CVE-2018-8407

Description

An information disclosure vulnerability exists when "Kernel Remote Procedure Call Provider" driver improperly initializes objects in memory, aka "MSRPC Information Disclosure Vulnerability." This affects Windows 7, Windows Server 2012 R2, Windows RT 8.1, Windows Server 2008, Windows Server 2019, Windows Server 2012, Windows 8.1, Windows Server 2016, Windows Server 2008 R2, Windows 10, Windows 10 Servers.

Related CPE's

omicrosoftwindows_server_2008r2sp1****x64*

omicrosoftwindows_server_2012r2*******

omicrosoftwindows_server_2008r2sp1****itanium*

omicrosoftwindows_101607*******

omicrosoftwindows_8.1-*******

omicrosoftwindows_server_2016-*******

omicrosoftwindows_server_2008-sp2******

omicrosoftwindows_7-sp1******

omicrosoftwindows_rt_8.1-*******

omicrosoftwindows_101703*******

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8407

PatchVendor Advisory

1042123

Third Party AdvisoryVDB Entry

105794

Third Party AdvisoryVDB Entry

CvssV3 impact

BaseSeverity

MEDIUM

ConfidentialityImpact

HIGH

AttackComplexity

LOW

Scope

UNCHANGED

AttackVector

LOCAL

AvailabilityImpact

NONE

IntegrityImpact

NONE

PrivilegesRequired

LOW

BaseScore

5.5

VectorString

CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N

Version

3.0

UserInteraction

NONE

CvssV2 impact

Version

2.0

VectorString

AV:L/AC:L/Au:N/C:P/I:N/A:N

AccessVector

LOCAL

AccessComplexity

LOW

Authentication

NONE

ConfidentialityImpact

PARTIAL

IntegrityImpact

NONE

AvailabilityImpact

NONE

BaseScore

2.0999999046325684

Created by Yello
About Severity.io