OnlyPatch
Windows Shell

CVE-2018-8314 — Windows Elevation of Privilege Vulnerability

Important CVSS 4.3 📢 Publicly disclosed 2018-07 archive

Executive Summary

An elevation of privilege vulnerability exists when Windows fails a check, allowing a sandbox escape. An attacker who successfully exploited the vulnerability could use the sandbox escape to elevate privileges on an affected system. This vulnerability by itself does not allow arbitrary code execution. However, the vulnerability could allow arbitrary code to run if an attacker uses it in combination with another vulnerability, such as a remote code execution vulnerability or another elevation of privilege vulnerability, that can leverage the elevated privileges when code execution is attempted. The security update addresses the vulnerability by correcting how Windows file picker handles paths.

Overview

4.3
CVSS MEDIUM
Important
MS Severity
Not Exploited
MS Exploit Status
N/A
MS Exploit Likelihood
Category Elevation of Privilege
Released Jul 10 2018
Last Updated Jul 10 2018
Publicly Disclosed Yes
CISA KEV Not Listed
Known Exploits None Known

CVSS Vector

ATTACK VECTOR
Network
ATTACK COMPLEXITY
Low
PRIVILEGES REQUIRED
None
USER INTERACTION
Required
SCOPE
Unchanged
CONFIDENTIALITY
None
INTEGRITY
Low
AVAILABILITY
None
EXPLOIT CODE MATURITY
Proof-of-Concept
REMEDIATION LEVEL
Official Fix
REPORT CONFIDENCE
Confirmed
Temporal Score: 3.9

EPSS Score

No EPSS score available for this CVE.

View on FIRST.org

Affected Products

6 affected products
Product KB Article Severity Impact Restart Required
Windows 10 for 32-bit Systems 4338829 (Security Update) 4345455 (Alternate Cumulative) Important Elevation of Privilege 4284860 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Yes None Windows 10 for x64-based Systems 4338829 (Security Update) 4345455 (Alternate Cumulative) Important Elevation of Privilege 4284860 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Yes None Windows 7 for 32-bit Systems Service Pack 1 4338818 (Monthly Rollup) 4338823 (Security Only) 4338821 (Preview Rollup) 4345459 (Standalone) Important Elevation of Privilege 4284826 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Yes None Windows 7 for x64-based Systems Service Pack 1 4338818 (Monthly Rollup) 4338823 (Security Only) 4338821 (Preview Rollup) 4345459 (Standalone) Important Elevation of Privilege 4284826 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Yes None Windows 8.1 for 32-bit systems 4338815 (Monthly Rollup) 4338824 (Security Only) 4338831 (Preview Rollup) 4345424 (Standalone) Important Elevation of Privilege 4284815 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Yes None Windows 8.1 for x64-based systems 4338815 (Monthly Rollup) 4338824 (Security Only) 4338831 (Preview Rollup) 4345424 (Standalone) Important Elevation of Privilege 4284815 Base: 4.3 Temporal: 3.9 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N/E:P/RL:O/RC:C Yes None Windows RT 8.1 4338815 (Monthly Rollup) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 4339503 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for 32-bit Systems Service Pack 2 (Server Core installation) 4339503 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for Itanium-Based Systems Service Pack 2 4339503 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for x64-based Systems Service Pack 2 4339503 (Security Update) Important Elevation of Privilege Yes
Windows Server 2008 for x64-based Systems Service Pack 2 (Server Core installation) 4339503 (Security Update) Important Elevation of Privilege Yes

Patches

2 patches
Article Type Restart
4338815 Monthly Rollup Yes
4339503 Security Update Yes

Known Exploits

Acknowledgments

None

On This Page