Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2010-3338 — Improper Input Validation in Microsoft Windows Server 2008

CWE-20 — Improper Input Validation8 documents6 sources
Severity
7.2HIGHNVD
EPSS
63.3%
top 1.59%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Windows Server 2008
Timeline
PublishedDec 16
Latest updateMay 14

Description

The Windows Task Scheduler in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly determine the security context of scheduled tasks, which allows local users to gain privileges via a crafted application, aka "Task Scheduler Vulnerability." NOTE: this might overlap CVE-2010-3888.

CVSS vector

AV:L/AC:L/C:C/I:C/A:CExploitability: 3.9 | Impact: 10.0

Affected Packages1 packages

🔴Vulnerability Details

2
GHSA
GHSA-mpmp-qx9g-mvg3: The Windows Task Scheduler in Microsoft Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, and R2, and Windows 7 does not properly determine th↗2022-05-14
▶
VulnCheck
Microsoft Windows Improper Input Validation↗2010
▶

💥Exploits & PoCs

4
Exploit-DB
Microsoft Windows - Task Scheduler '.XML' Local Privilege Escalation (MS10-092) (Metasploit)↗2012-07-19
▶
Exploit-DB
Microsoft Windows - Task Scheduler Privilege Escalation↗2010-11-20
▶
Exploit-DB
CA Advantage Ingres 2.6 - Multiple Buffer Overflow Vulnerabilities (PoC)↗2010-08-14
▶
Metasploit
Windows Escalate Task Scheduler XML Privilege Escalation↗
▶

🕵️Threat Intelligence

1
Zscaler
Zscaler found Multiple Security Vulnerabilities | 12-14-2010↗
▶