High severity · published May 9, 2018
CVE-2018-8173
A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote Code Execution…
7.8
CVSS
19.6%
EPSS
No
On KEV
Description
A remote code execution vulnerability exists in Microsoft InfoPath when the software fails to properly handle objects in memory, aka "Microsoft InfoPath Remote Code Execution Vulnerability." This affects Microsoft Infopath.
CVSS vector
CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
Attack vector
Local
Complexity
Low
Privileges
None
User interaction
Required
Confidentiality
High
Integrity
High
Availability
High
Scope
Unchanged
Exploitation
Is it being used?
Exploit prediction (EPSS)19.6% · higher than 97% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IN
Infopath · Microsoft
2013 · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2018-8173
CVE.org
https://www.cve.org/CVERecord?id=CVE-2018-8173
Third Party Advisory
http://www.securityfocus.com/bid/104069
Third Party Advisory
http://www.securitytracker.com/id/1040855
Patch
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8173
More from Infopath
8.8
CVE-2007-0671
Microsoft Office Excel Remote Code Execution Vulnerability
7.8
CVE-2016-0021
Microsoft InfoPath 2007 SP3, 2010 SP2, and 2013 SP1 allows remote attackers to execute arbitrary code via a crafted Office document, aka "Microsoft Office Memory Corruption…
–
CVE-2015-2503
Microsoft Access 2007 SP3, Excel 2007 SP3, InfoPath 2007 SP3, OneNote 2007 SP3, PowerPoint 2007 SP3, Project 2007 SP3, Publisher 2007 SP3, Visio 2007 SP3, Word 2007 SP3, Office…
–
CVE-2013-1289
Cross-site scripting (XSS) vulnerability in Microsoft SharePoint Server 2010 SP1, Groove Server 2010 SP1, SharePoint Foundation 2010 SP1, and Office Web Apps 2010 SP1 allows…
–
CVE-2012-2520
Cross-site scripting (XSS) vulnerability in Microsoft InfoPath 2007 SP2 and SP3 and 2010 SP1, Communicator 2007 R2, Lync 2010 and 2010 Attendee, SharePoint Server 2007 SP2 and SP3…