CVE-2018-8504 : A remote code execution vulnerability exists in Microsoft Word software when the

A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View, aka "Microsoft Word Remote Code Execution Vulnerability." This affects Microsoft SharePoint Server, Office 365 ProPlus, Microsoft Office, Microsoft Word.

Published 2018-10-10 13:29:05

Updated 2019-10-03 00:03:26

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Execute code

Products affected by CVE-2018-8504

Microsoft » Office » Version: 2013 Update SP1
cpe:2.3:a:microsoft:office:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2010 Update SP2
cpe:2.3:a:microsoft:office:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2013 Update SP1 RT Edition
cpe:2.3:a:microsoft:office:2013:sp1:*:*:rt:*:*:*
Matching versions
Microsoft » Office » Version: 2016
cpe:2.3:a:microsoft:office:2016:*:*:*:*:*:*:*
Matching versions
Microsoft » Office » Version: 2019
cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*
Matching versions
Microsoft » Word » Version: 2010 Update SP2
cpe:2.3:a:microsoft:word:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Word » Version: 2013 Update SP1
cpe:2.3:a:microsoft:word:2013:sp1:*:*:*:*:*:*
Matching versions
Microsoft » Word » Version: 2013 Update SP1 RT Edition
cpe:2.3:a:microsoft:word:2013:sp1:*:*:rt:*:*:*
Matching versions
Microsoft » Word » Version: 2016
cpe:2.3:a:microsoft:word:2016:*:*:*:*:*:*:*
Matching versions
Microsoft » Sharepoint Server » Version: 2010 Update SP2
cpe:2.3:a:microsoft:sharepoint_server:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office Web Apps » Version: 2010 Update SP2
cpe:2.3:a:microsoft:office_web_apps:2010:sp2:*:*:*:*:*:*
Matching versions
Microsoft » Office 365 Proplus » Version: N/A
cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*
Matching versions

Exploit prediction scoring system (EPSS) score for CVE-2018-8504

EPSS FAQ

15.77%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 96 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2018-8504

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
9.3	HIGH	AV:N/AC:M/Au:N/C:C/I:C/A:C	8.6	10.0	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Complete Integrity Impact: Complete Availability Impact: Complete
8.8	HIGH	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H	2.8	5.9	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: High Availability: High

References for CVE-2018-8504

http://www.securityfocus.com/bid/105499

Microsoft Word CVE-2018-8504 Remote Code Execution Vulnerability
Third Party Advisory;VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8504

CVE-2018-8504 | Microsoft Word Remote Code Execution Vulnerability
Patch;Vendor Advisory
http://www.securitytracker.com/id/1041840

Microsoft Word File Processing Flaw Lets Remote Users Execute Arbitrary Code - SecurityTracker
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2018-8504

Products affected by CVE-2018-8504

Exploit prediction scoring system (EPSS) score for CVE-2018-8504

CVSS scores for CVE-2018-8504

References for CVE-2018-8504