Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2017-0214 — Corporation Windows COM vulnerability

7 documents5 sources
Severity
7.3HIGHNVD
NVD7.0
EPSS
1.4%
top 19.61%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
16
Microsoft Corporation Windows COMMicrosoft Windows 10Microsoft Windows Server 2008+13 more
Timeline
PublishedMay 12
Latest updateMay 13

Description

Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows RT 8.1, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an elevation privilege vulnerability when Windows fails to properly validate input before loading type libraries, aka "Windows COM Elevation of Privilege Vulnerability". This CVE ID is unique from CVE-2017-0213.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages15 packages

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-6pc8-xvmj-x3wh: Windows COM Aggregate Marshaler in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8↗2022-05-13
▶
GHSA
GHSA-8cpc-fr8p-99pq: Windows COM in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8↗2022-05-13
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows - Running Object Table Register ROTFLAGS_ALLOWANYCLIENT Privilege Escalation↗2017-05-17
▶

📋Vendor Advisories

1
Microsoft
Windows COM Elevation of Privilege Vulnerability↗2017-05-09
▶

🕵️Threat Intelligence

1
Talos
Microsoft Patch Tuesday - May 2017↗2017-05-10
▶
CVE-2017-0214 — Corporation Windows COM vulnerability | cvebase