CVE-2018-8244
published 2018-06-14CVE-2018-8244: An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of…
PriorityP434medium6.5CVSS 3.0
AVNACLPRNUIRSUCNIHAN
EPSS
5.22%
92.5th percentile
An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook.
Affected
20 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_office | — | — |
| microsoft | microsoft_outlook | — | — |
| microsoft | microsoft_outlook | — | — |
| microsoft | microsoft_outlook | — | — |
| microsoft | microsoft_outlook | — | — |
| microsoft | microsoft_outlook | — | — |
| microsoft | microsoft_outlook | — | — |
| microsoft | microsoft_outlook | — | — |
| microsoft | office | — | — |
| microsoft | outlook | — | — |
| microsoft | outlook | — | — |
| microsoft | outlook | — | — |
| microsoft | outlook_rt | — | — |
| msrc | microsoft_office_2016_click-to-run_for_32-bit_editions | — | — |
| msrc | microsoft_office_2016_click-to-run_for_64-bit_editions | — | — |
| msrc | microsoft_outlook_2010_service_pack_2 | — | — |
| msrc | microsoft_outlook_2013_rt_service_pack_1 | — | — |
| msrc | microsoft_outlook_2013_service_pack_1 | — | — |
| msrc | microsoft_outlook_2016 | — | — |
CVSS provenance
nvdv3.06.5MEDIUMCVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:H/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
vendor_msrc6.5HIGH
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-hw92-6x7q-xg4p: An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation
ghsa_unreviewed·2022-05-14
CVE-2018-8244 [MEDIUM] CWE-20 GHSA-hw92-6x7q-xg4p: An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation
An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly, aka "Microsoft Outlook Elevation of Privilege Vulnerability." This affects Microsoft Office, Microsoft Outlook.
Microsoft
Microsoft Outlook Elevation of Privilege Vulnerability
vendor_msrc·2018-06-12·CVSS 6.5
CVE-2018-8244 [MEDIUM] Microsoft Outlook Elevation of Privilege Vulnerability
Microsoft Outlook Elevation of Privilege Vulnerability
Description: An elevation of privilege vulnerability exists when Microsoft Outlook does not validate attachment headers properly. An attacker who successfully exploited the vulnerability could send an email with hidden attachments that would be opened or executed once a victim clicks a link within the email. Note that this does not bypass attachment filters, so blocked attachments will still be excluded.
To exploit the vulnerability, the attacker could send a specially crafted email to a victim. The victim would then be required to click on a link within the email to open or execute a malicious attachment.
This update addresses the vulnerability by changing the way that Outlook parses attachment headers.
FAQ: I am being offered this
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/104323http://www.securitytracker.com/id/1041107https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8244http://www.securityfocus.com/bid/104323http://www.securitytracker.com/id/1041107https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8244
2018-06-14
Published