Vulnerability Name: CVE-2018-8284 (CCN-145372) Assigned: 2018-07-10 Published: 2018-07-10 Updated: 2022-05-23 Summary: A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2. CVSS v3 Severity: 8.1 High (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H )7.1 High (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): NetworkAttack Complexity (AC): HighPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
8.4 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H )7.3 High (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H/E:U/RL:O/RC:C )Exploitability Metrics: Attack Vector (AV): LocalAttack Complexity (AC): LowPrivileges Required (PR): NoneUser Interaction (UI): NoneScope: Scope (S): UnchangedImpact Metrics: Confidentiality (C): HighIntegrity (I): HighAvailibility (A): High
CVSS v2 Severity: 9.3 High (CVSS v2 Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): NetworkAccess Complexity (AC): MediumAuthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
7.2 High (CCN CVSS v2 Vector: AV:L/AC:L/Au:N/C:C/I:C/A:C )Exploitability Metrics: Access Vector (AV): LocalAccess Complexity (AC): LowAthentication (Au): NoneImpact Metrics: Confidentiality (C): CompleteIntegrity (I): CompleteAvailibility (A): Complete
Vulnerability Type: CWE-94 Vulnerability Consequences: Gain Access References: Source: MITRE Type: CNACVE-2018-8284 Source: BID Type: Third Party Advisory, VDB Entry104667 Source: CCN Type: BID-104667Microsoft .NET Framework CVE-2018-8284 Remote Code Execution Vulnerability Source: SECTRACK Type: Third Party Advisory, VDB Entry1041257 Source: XF Type: UNKNOWNms-dotnet-cve20188284-code-exec(145372) Source: CCN Type: Microsoft Security TechCenter - July 2018.NET Framework Remote Code Injection Vulnerability Source: CONFIRM Type: Patch, Vendor Advisoryhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8284 Vulnerable Configuration: Configuration 1 :cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:* AND cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* Configuration 2 :cpe:/a:microsoft:.net_framework:3.5:-:*:*:*:*:*:* AND cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_10:1607:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_10:1703:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_10:1709:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_10:1803:*:*:*:*:*:*:* Configuration 3 :cpe:/a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_7:-:sp1:*:*:*:*:*:* Configuration 4 :cpe:/a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_7:-:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* Configuration 5 :cpe:/a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:*:* Configuration 6 :cpe:/a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_10:1607:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2016:-:*:*:*:*:*:*:* Configuration 7 :cpe:/a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_10:-:*:*:*:*:*:*:* Configuration 8 :cpe:/a:microsoft:.net_framework:4.6.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_8.1:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_7:-:sp1:*:*:*:*:*:* OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* Configuration 9 :cpe:/a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_10:1709:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server:1709:*:*:*:*:*:*:* Configuration 10 :cpe:/a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_10:1803:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server:1803:*:*:*:*:*:*:* Configuration 11 :cpe:/a:microsoft:.net_framework:4.7:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_10:1703:*:*:*:*:*:*:* Configuration 12 :cpe:/a:microsoft:project_server:2013:sp1:*:*:*:*:*:* OR cpe:/a:microsoft:project_server:2010:sp2:*:*:*:*:*:* Configuration 13 :cpe:/a:microsoft:sharepoint_enterprise_server:2016:*:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_enterprise_server:2013:sp1:*:*:*:*:*:* Configuration 14 :cpe:/a:microsoft:sharepoint_foundation:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_foundation:2013:sp1:*:*:*:*:*:* Configuration 15 :cpe:/a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:sharepoint_server:2013:sp1:*:*:*:*:*:* Configuration CCN 1 :cpe:/a:microsoft:.net_framework:2.0:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:3.5:-:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:3.5.1:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:3.0:sp2:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.5.2:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.6:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.6.2:*:*:*:*:*:*:* OR cpe:/a:microsoft:.net_framework:4.7.2:*:*:*:*:*:*:* AND cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x32:* OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:x64:* OR cpe:/o:microsoft:windows_server_2008:*:sp2:*:*:*:*:itanium:* OR cpe:/o:microsoft:windows_7:-:sp1:-:*:-:-:x32:* OR cpe:/o:microsoft:windows_7:*:sp1:x64:*:*:*:*:* OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:x64:* OR cpe:/o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:itanium:* OR cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x32:* OR cpe:/o:microsoft:windows_8.1:-:*:*:*:*:*:x64:* OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x32:* OR cpe:/o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:* OR cpe:/o:microsoft:windows_server_2016:*:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server:1709:*:*:*:*:*:*:* OR cpe:/o:microsoft:windows_server:1803:*:*:*:*:*:*:* Denotes that component is vulnerable BACK
microsoft .net framework 2.0 sp2
microsoft .net framework 3.0 sp2
microsoft windows server 2008 - sp2
microsoft .net framework 3.5
microsoft windows server 2012 r2
microsoft windows server 2016 *
microsoft windows 10 1607
microsoft windows 8.1 *
microsoft windows server 2012 *
microsoft windows 10 1703
microsoft windows 10 -
microsoft windows 10 1709
microsoft windows 10 1803
microsoft .net framework 3.5.1
microsoft windows server 2008 r2 sp1
microsoft windows 7 - sp1
microsoft .net framework 4.5.2
microsoft windows server 2012 r2
microsoft windows 8.1 *
microsoft windows server 2008 r2 sp1
microsoft windows 7 - sp1
microsoft windows rt 8.1 -
microsoft windows server 2012 *
microsoft windows server 2008 * sp2
microsoft .net framework 4.6
microsoft windows server 2008 * sp2
microsoft .net framework 4.6.2
microsoft .net framework 4.7
microsoft .net framework 4.7.1
microsoft .net framework 4.7.2
microsoft windows 10 1607
microsoft windows server 2016 -
microsoft .net framework 4.6.1
microsoft .net framework 4.6
microsoft .net framework 4.6.2
microsoft windows 10 -
microsoft .net framework 4.6.1
microsoft .net framework 4.6
microsoft .net framework 4.6.2
microsoft .net framework 4.7
microsoft .net framework 4.7.1
microsoft .net framework 4.7.2
microsoft windows server 2012 r2
microsoft windows 8.1 *
microsoft windows server 2008 r2 sp1
microsoft windows 7 - sp1
microsoft windows rt 8.1 -
microsoft windows server 2012 *
microsoft .net framework 4.7.1
microsoft .net framework 4.7.2
microsoft windows 10 1709
microsoft windows server 1709
microsoft .net framework 4.7.2
microsoft windows 10 1803
microsoft windows server 1803
microsoft .net framework 4.7
microsoft .net framework 4.7.1
microsoft .net framework 4.7.2
microsoft windows 10 1703
microsoft project server 2013 sp1
microsoft project server 2010 sp2
microsoft sharepoint enterprise server 2016
microsoft sharepoint enterprise server 2013 sp1
microsoft sharepoint foundation 2010 sp2
microsoft sharepoint foundation 2013 sp1
microsoft sharepoint server 2010 sp2
microsoft sharepoint server 2013 sp1
microsoft .net framework 2.0 sp2
microsoft .net framework 3.5
microsoft .net framework 3.5.1
microsoft .net framework 3.0 sp2
microsoft .net framework 4.5.2
microsoft .net framework 4.6
microsoft .net framework 4.6.2
microsoft .net framework 4.7.2
microsoft windows server 2008 sp2
microsoft windows server 2008 sp2
microsoft windows server 2008
microsoft windows 7 - sp1
microsoft windows 7 * sp1
microsoft windows server 2008 r2 sp1
microsoft windows server 2008 r2 sp1
microsoft windows server 2012
microsoft windows 8.1 - -
microsoft windows 8.1 -
microsoft windows server 2012 r2
microsoft windows rt 8.1 *
microsoft windows 10 -
microsoft windows 10 -
microsoft windows server 2016
microsoft windows server 1709
microsoft windows server 1803