CVE-2018-0884 : Windows Scripting Host (WSH) in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, vers

Windows Scripting Host (WSH) in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a security feature bypass vulnerability due to how objects are handled in memory, aka "Windows Security Feature Bypass Vulnerability". This CVE is unique from CVE-2018-0902.

Published 2018-03-14 17:29:01

Updated 2022-05-23 17:29:16

Source Microsoft Corporation

View at NVD, CVE.org

Exploit prediction scoring system (EPSS) score for CVE-2018-0884

EPSS FAQ

0.07%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 30 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-0884

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.6	MEDIUM	AV:L/AC:L/Au:N/C:P/I:P/A:P	3.9	6.4	NIST
Access Vector: Local Access Complexity: Low Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial
7.8	HIGH	CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H	1.8	5.9	NIST
Attack Vector: Local Attack Complexity: Low Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2018-0884

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0884

CVE-2018-0884 | Windows Security Feature Bypass Vulnerability
Patch;Vendor Advisory
http://www.securityfocus.com/bid/103260

Microsoft Windows Device Guard CVE-2018-0884 Local Security Bypass Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1040522

Windows Scripting Host Object Memory Handling Error Lets Local Users Bypass Device Guard Security Restrictions - SecurityTracker
Third Party Advisory;VDB Entry

Products affected by CVE-2018-0884

Microsoft » Windows Server » Version: 1709
cpe:2.3:o:microsoft:windows_server:1709:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 » Version: N/A
cpe:2.3:o:microsoft:windows_10:-:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 » Version: 1511
cpe:2.3:o:microsoft:windows_10:1511:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 » Version: 1607
cpe:2.3:o:microsoft:windows_10:1607:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 » Version: 1703
cpe:2.3:o:microsoft:windows_10:1703:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows 10 » Version: 1709
cpe:2.3:o:microsoft:windows_10:1709:*:*:*:*:*:*:*
Matching versions
Microsoft » Windows Server 2016 » Version: N/A
cpe:2.3:o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*
Matching versions

Vulnerability Details : CVE-2018-0884

Exploit prediction scoring system (EPSS) score for CVE-2018-0884

CVSS scores for CVE-2018-0884

References for CVE-2018-0884

Products affected by CVE-2018-0884