CVE-2018-8493 — Sensitive Information Exposure in Microsoft Windows 10

4 documents4 sources

Severity

7.5HIGHNVD

EPSS

11.8%

top 6.27%

CISA KEV

Not in KEV

Exploit

No known exploits

Affected products

Microsoft Windows 10 Microsoft Windows 10 Servers Microsoft Windows 8.1 +4 more

Timeline

PublishedOct 10

Latest updateMay 13

Description

An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information Disclosure Vulnerability." This affects Windows Server 2012 R2, Windows RT 8.1, Windows Server 2016, Windows 8.1, Windows 10, Windows 10 Servers.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:NExploitability: 3.9 | Impact: 3.6

Affected Packages7 packages

▶CVEListV5microsoft/windows_10_serversversion 1709 (Server Core Installation), version 1803 (Server Core Installation)+1

▶CVEListV5microsoft/windows_server_2016(Server Core installation)

▶CVEListV5microsoft/windows_server_2012_r2(Server Core installation)

▶NVDmicrosoft/windowsr2

▶CVEListV5microsoft/windows_1010 versions+9

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

GHSA

GHSA-fpxg-2rm2-vpj4: An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information↗2022-05-13

▶

CVEList

CVE-2018-8493: An information disclosure vulnerability exists when the Windows TCP/IP stack improperly handles fragmented IP packets, aka "Windows TCP/IP Information↗2018-10-10

▶

📋Vendor Advisories

Microsoft

Windows TCP/IP Information Disclosure Vulnerability↗2018-10-09

▶