9.3
CVSSv2

CVE-2018-8414

Published: 15/08/2018 Updated: 23/05/2022
CVSS v2 Base Score: 9.3 | Impact Score: 10 | Exploitability Score: 8.6
CVSS v3 Base Score: 8.8 | Impact Score: 5.9 | Exploitability Score: 2.8
VMScore: 829
Vector: AV:N/AC:M/Au:N/C:C/I:C/A:C

Vulnerability Summary

A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka "Windows Shell Remote Code Execution Vulnerability." This affects Windows 10 Servers, Windows 10.

Vulnerability Trend

Vulnerable Product Search on Vulmon Subscribe to Product

microsoft windows 10 1703

microsoft windows 10 1709

microsoft windows server 1709

microsoft windows 10 1803

microsoft windows server 1803

Github Repositories

Exploits Drupalgeddon2 [CVE-2018-7600]: $ ruby -v ruby 251p57 (2018-03-29 revision 63029) [x86_64-linux-gnu] $ ruby drupalgeddon2rb examplecom $ ruby drupalgeddon2-not-write-shellrb <target> <version [7,8]> <command> [php_method] [form_path] ruby drupalgeddon2-not-write-shellrb 7

Simple poc of CVE-2018-8414 Windows Package Setting RCE Vulnerability

CVE-2018-8414 POC Windows Shell Package Setting Remote Code Execution Vulnerability Since : Windows 10 Version 1703 to 1803 / Windows Server Version 1709 to 1803 Note : Some time the exploit fail depending of the file location (default policy settings), so for that just copy the file in the Package Settings Dir and it should execute rightly C:\Users\[USER]\AppData\Local\Packag

Simple poc of CVE-2018-8414 Windows Package Setting RCE Vulnerability

CVE-2018-8414 POC Windows Shell Package Setting Remote Code Execution Vulnerability Since : Windows 10 Version 1703 to 1803 / Windows Server Version 1709 to 1803 Note : Some time the exploit fail depending of the file location (default policy settings), so for that just copy the file in the Package Settings Dir and it should execute rightly C:\Users\[USER]\AppData\Local\Packag

Recent Articles

IT threat evolution Q3 2018. Statistics
Securelist • Victor Chebyshev Fedor Sinitsyn Denis Parinov Oleg Kupreev Evgeny Lopatin Alexander Liskin • 12 Nov 2018

These statistics are based on detection verdicts of Kaspersky Lab products received from users who consented to provide statistical data. According to Kaspersky Security Network: Perhaps the biggest news of the reporting period was the Trojan-Banker.AndroidOS.Asacub epidemic. It peaked in September when more than 250,000 unique users were attacked – and that only includes statistics for those with Kaspersky Lab’s mobile products installed on their devices. Number of users attacked by the mob...

Patch Tuesday heats up with pair of exploited zero-days squashed – plus 58 other vulns fixed
The Register • Shaun Nichols in San Francisco • 14 Aug 2018

Summertiiiiiime, and the hacking is easy Oracle: Run, don't walk, to patch this critical Database takeover bug

Microsoft and Adobe have teamed up to deliver more than 70 patches with this month's Patch Tuesday batch released today. Microsoft contributed the bulk of the fixes emitted this month, kicking out updates for 60 CVE-listed vulnerabilities in its products. These should be installed as soon as you're able to test and deploy them. Among the highest priorities are a pair of zero-day bugs that are right now being exploited in the wild to compromise victims' Windows PCs. CVE-2018-8373, a remote code e...