7.5high
CVE-2018-8552in critical feed1 exploit
An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attack…
Published 7 y ago · modified 4 mo ago · JSON
CVSS
7.5
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
51.0%
percentile 99%
Public exploits
1
Exploit-DB
Summary
An information disclosure vulnerability exists when VBScript improperly discloses the contents of its memory, which could provide an attacker with information to further compromise the user's computer or data, aka "Windows Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10.
Exploit prediction (EPSS)
50.96% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.
Exploits and detections
- EDB-45924 VBScript - 'rtFilter' Out-of-Bounds Read · dos · 2018-11-30
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 7.5 | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Internet Explorer 9
- Microsoft Internet Explorer 11
- Microsoft Internet Explorer 10
Classification
- Weakness
- CWE-119 Improper Restriction of Operations within the Bounds of a Memory Buffer
References
- securityfocus.com /bid/105786 · vdb-entry, x_refsource_BID, x_transferred
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8552 · x_refsource_CONFIRM, x_transferred
- exploit-db.com /exploits/45924/ · exploit, x_refsource_EXPLOIT-DB, x_transferred
Sources
- CVE List: CVE-2018-8552
- NVD: CVE-2018-8552
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.