cbcvebase.
CVE-2018-8302
published 2018-08-15

CVE-2018-8302: A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft…

PriorityP264critical9.8CVSS 3.0
AVNACLPRNUINSUCHIHAH
EPSS
25.52%
97.7th percentile
A remote code execution vulnerability exists in Microsoft Exchange software when the software fails to properly handle objects in memory, aka "Microsoft Exchange Memory Corruption Vulnerability." This affects Microsoft Exchange Server.

Affected

34 ranges· showing 25
VendorProductVersion rangeFixed in
microsoftexchange_server
microsoftexchange_server
microsoftexchange_server
microsoftexchange_server
microsoftexchange_server
microsoftmicrosoft_exchange_server
microsoftmicrosoft_exchange_server
microsoftmicrosoft_exchange_server
microsoftmicrosoft_exchange_server
microsoftmicrosoft_exchange_server
msrcmicrosoft_exchange_server_2010_service_pack_3
msrcmicrosoft_exchange_server_2010_service_pack_3_update_rollup_23
msrcmicrosoft_exchange_server_2013_cumulative_update_20
msrcmicrosoft_exchange_server_2013_cumulative_update_21
msrcmicrosoft_exchange_server_2013_cumulative_update_22
msrcmicrosoft_exchange_server_2013_cumulative_update_23
msrcmicrosoft_exchange_server_2013_service_pack_1
msrcmicrosoft_exchange_server_2016_cumulative_update_10
msrcmicrosoft_exchange_server_2016_cumulative_update_11
msrcmicrosoft_exchange_server_2016_cumulative_update_12
msrcmicrosoft_exchange_server_2016_cumulative_update_13
msrcmicrosoft_exchange_server_2016_cumulative_update_14
msrcmicrosoft_exchange_server_2016_cumulative_update_15
msrcmicrosoft_exchange_server_2016_cumulative_update_16
msrcmicrosoft_exchange_server_2016_cumulative_update_17

Detection & IOCsextracted from sources · hover to see the quote

  • CVE-2018-8302 is triggered by a specially crafted email sent to a vulnerable Exchange server — monitor for anomalous inbound email traffic to Exchange that triggers memory corruption, and alert on Exchange worker processes spawning unexpected child processes (indicative of SYSTEM-level code execution).
  • Successful exploitation results in arbitrary code running as the SYSTEM user on the Exchange server — monitor Exchange server processes for unexpected privilege escalation or new account creation activity.
  • Exploitation requires access to mailbox account setup — restrict and audit Exchange mailbox provisioning permissions; alert on non-administrative accounts attempting mailbox configuration changes.
  • ·As of the advisory publication, CVE-2018-8302 had not been publicly disclosed or observed exploited in the wild — prioritize patching but active exploitation indicators are not yet available.

CVSS provenance

nvdv3.09.8CRITICALCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H
nvdv2.010.0CRITICALAV:N/AC:L/Au:N/C:C/I:C/A:C
vendor_msrc9.8CRITICAL
Stop checking back — get the weekly exploitation signal.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.