CVE-2018-8284

high-risk

Published 2018-07-11

A remote code execution vulnerability exists when the Microsoft .NET Framework fails to validate input properly, aka ".NET Framework Remote Code Injection Vulnerability." This affects Microsoft .NET Framework 2.0, Microsoft .NET Framework 3.0, Microsoft .NET Framework 4.6.2/4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.5.2, Microsoft .NET Framework 4.6, Microsoft .NET Framework 4.7/4.7.1/4.7.2, Microsoft .NET Framework 4.7.1/4.7.2, Microsoft .NET Framework 3.5, Microsoft .NET Framework 3.5.1, Microsoft .NET Framework 4.6/4.6.1/4.6.2, Microsoft .NET Framework 4.6/4.6.1/4.6.2/4.7/4.7.1/4.7.1/4.7.2, Microsoft .NET Framework 4.7.2.

Do I need to act?

30.2% chance of exploitation in next 30 days

EPSS score — higher than 70% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 8.1/10 High

NETWORK / HIGH complexity

Affected Products (19)

.Net Framework

Project Server

Sharepoint Enterprise Server

Sharepoint Foundation

Sharepoint Server

Affected Vendors

Microsoft

References (6)

Third Party Advisory http://www.securityfocus.com/bid/104667

Third Party Advisory http://www.securitytracker.com/id/1041257

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8284

Third Party Advisory http://www.securityfocus.com/bid/104667

Third Party Advisory http://www.securitytracker.com/id/1041257

Patch https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8284

/ 100

high-risk

Severity 24/34 · High

Exploitability 15/34 · Moderate

Exposure 19/34 · Moderate