Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-0058 — Sensitive Information Exposure in Corporation Windows

CWE-200 — Sensitive Information Exposure4 documents4 sources
Severity
4.7MEDIUMNVD
EPSS
16.5%
top 5.09%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
18
Microsoft Corporation WindowsMicrosoft Windows 10Microsoft Windows Server 2008+15 more
Timeline
PublishedApr 12
Latest updateMay 17

Description

A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information. An attacker who successfully exploited the vulnerability could obtain information to further compromise the user's system, aka "Win32k Information Disclosure Vulnerability."

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:N/A:NExploitability: 1.0 | Impact: 3.6

Affected Packages17 packages

▶NVDmicrosoft/windows_101511, 1607, 1703+2

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

1
GHSA
GHSA-chmg-4q84-rx8x: A Win32k information disclosure vulnerability exists in Microsoft Windows when the win32k component improperly provides kernel information↗2022-05-17
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows Kernel - 'win32k.sys' Multiple 'NtGdiGetDIBitsInternal' System Call↗2017-04-13
▶

📋Vendor Advisories

1
Microsoft
Win32k Information Disclosure Vulnerability↗2017-04-11
▶
CVE-2017-0058 — Sensitive Information Exposure | cvebase