Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2018-0982 — Incorrect Permission Assignment in Microsoft Windows 10

CWE-732 — Incorrect Permission Assignment5 documents5 sources
Severity
7.0HIGHNVD
EPSS
14.2%
top 5.60%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
3
Microsoft Windows 10Microsoft Windows 10 ServersMicrosoft Windows Server 2016
Timeline
PublishedJun 14
Latest updateMay 13

Description

An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulnerability." This affects Windows Server 2016, Windows 10, Windows 10 Servers.

CVSS vector

CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:H/I:H/A:HExploitability: 1.0 | Impact: 5.9

Affected Packages5 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1
▶CVEListV5microsoft/windows_server_2016(Server Core installation)
▶NVDmicrosoft/windows1709, 1803+1
▶CVEListV5microsoft/windows_108 versions+7
▶NVDmicrosoft/windows_104 versions+3

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-pjqf-5ppg-9jpw: An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulner↗2022-05-13
▶
CVEList
CVE-2018-0982: An elevation of privilege vulnerability exists in the way that the Windows Kernel API enforces permissions, aka "Windows Elevation of Privilege Vulner↗2018-06-14
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows 10 - Child Process Restriction Mitigation Bypass↗2018-06-13
▶

📋Vendor Advisories

1
Microsoft
Windows Elevation of Privilege Vulnerability↗2018-06-12
▶
CVE-2018-0982 — Incorrect Permission Assignment | cvebase