| Vulnerability Name: | CVE-2018-8444 (CCN-149051) |
| Assigned: | 2018-09-11 |
| Published: | 2018-09-11 |
| Updated: | 2018-11-20 |
| Summary: | An information disclosure vulnerability exists in the way that the Microsoft Server Message Block 2.0 (SMBv2) server handles certain requests, aka "Windows SMB Information Disclosure Vulnerability." This affects Windows Server 2012, Windows 10, Windows 8.1, Windows RT 8.1, Windows Server 2012 R2.
|
| CVSS v3 Severity: | 5.9 Medium (CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N)
5.2 Medium (Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:N/A:N/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): None
Availibility (A): None |
7.0 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L)
6.1 Medium (CCN Temporal CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:L/E:U/RL:O/RC:C)| Exploitability Metrics: | Attack Vector (AV): Network
Attack Complexity (AC): High
Privileges Required (PR): None
User Interaction (UI): None | | Scope: | Scope (S): Unchanged
| | Impact Metrics: | Confidentiality (C): High
Integrity (I): Low
Availibility (A): Low |
|
| CVSS v2 Severity: | 4.3 Medium (CVSS v2 Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): Medium
Authentication (Au): None | | Impact Metrics: | Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None |
6.6 Medium (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:C/I:P/A:P)| Exploitability Metrics: | Access Vector (AV): Network
Access Complexity (AC): High
Athentication (Au): None
| | Impact Metrics: | Confidentiality (C): Complete
Integrity (I): Partial
Availibility (A): Partial |
|
| Vulnerability Type: | CWE-200
|
| Vulnerability Consequences: | Obtain Information |
| References: | Source: MITRE
Type: CNA
CVE-2018-8444
Source: BID
Type: Third Party Advisory, VDB Entry
105226
Source: CCN
Type: BID-105226
Microsoft Windows SMB Server CVE-2018-8444 Information Disclosure Vulnerability
Source: XF
Type: UNKNOWN
ms-smb-cve20188444-info-disc(149051)
Source: CCN
Type: Microsoft Security TechCenter - September 2018
Windows SMB Information Disclosure Vulnerability
Source: CONFIRM
Type: Patch, Vendor Advisory
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8444
|
| Vulnerable Configuration: | Configuration 1:
cpe:/o:microsoft:windows_10:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*
Configuration CCN 1:
cpe:/o:microsoft:windows_server_2012:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x32:*OR cpe:/o:microsoft:windows_8.1:-:*:*:*:*:*:x64:*OR cpe:/o:microsoft:windows_server_2012:r2:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_rt_8.1:*:*:*:*:*:*:*:*OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x32:*OR cpe:/o:microsoft:windows_10_1507:-:*:*:*:*:*:x64:*
 Denotes that component is vulnerable |
| BACK |