6.9
CVSSv2

CVE-2014-0315

Published: 08/04/2014 Updated: 24/07/2020
CVSS v2 Base Score: 6.9 | Impact Score: 10 | Exploitability Score: 3.4
VMScore: 614
Vector: AV:L/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability."

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows xp -

microsoft windows server 2008 r2

microsoft windows server 2012 r2

microsoft windows rt -

microsoft windows 8.1 -

microsoft windows server 2008 -

microsoft windows 7 -

microsoft windows rt 8.1 -

microsoft windows vista -

microsoft windows 8 -

microsoft windows server 2012 -

microsoft windows server 2003 -

Exploits

Various Eclipse installers suffer from a dll hijacking vulnerability ...
This post outlines multiple unsafe practices in Microsoft Windows that can allow for local privilege escalation ...

Mailing Lists

Hi @ll, This multi-part post can be read even without a MIME-compliant program! Back in 2014, I reported a vulnerability in CreateProcess()'s handling of *cmd and *bat files that Microsoft fixed with MS14-019 alias MSKB 2922229 and assigned CVE-2014-0315: command lines with a batch script as first token led to the execution of a (rogue) cmdexe ...