Main Vulnerability Database Vulnerabilities #VU11052

Remote code execution in Microsoft Windows and Windows Server - CVE-2018-0883

Published: March 13, 2018 / Updated: March 13, 2018

Vulnerability identifier: #VU11052

CSH Severity: High

CVSS v4: 8.6 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:H/VI:H/VA:H/SC:N/SI:N/SA:N]

CVE-ID: CVE-2018-0883

CWE-ID: CWE-20

Exploitation vector: Remote access

Exploit availability: No public exploit available

Vulnerability details

The vulnerability allows a remote attacker can execute arbitrary code on the target system.

The weakness exists due to improper validation of file copy destinations by Windows Shell. A remote attacker can trick the victim into opening a specially crafted file and execute arbitrary code with privileges of the current user.

Successful exploitation of the vulnerability may result in system compromise.

Affected software

Microsoft Windows
Windows Server

How to mitigate CVE-2018-0883

Install updates from vendor's website.

External References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0883

Related Security Bulletins