CVE-2018-8382

An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka "Microsoft Excel Information Disclosure Vulnerability." This affects Microsoft Excel Viewer, Microsoft Office, Microsoft Excel.

CVSS v3 5.5 MEDIUM
CVSS v2.0 4.3 MEDIUM

5.5^/10

CVSS v3 : MEDIUM

Vector : AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Exploitability : 1.8 / Impact : 3.6

Attack Vector LOCAL

Attack Complexity LOW

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact HIGH

Integrity Impact NONE

Availability Impact NONE

Scope UNCHANGED

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:P/I:N/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/105000	Third Party Advisory VDB Entry
http://www.securitytracker.com/id/1041463	Third Party Advisory VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8382	Patch Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:excel:2010:sp2::::::
	cpe:2.3:a:microsoft:excel:2013:sp1::::::
	cpe:2.3:a:microsoft:excel:2016:::::::*
	cpe:2.3:a:microsoft:excel:2016::::click-to-run:::
	cpe:2.3:a:microsoft:excel_2013_rt:sp1:::::::*
	cpe:2.3:a:microsoft:excel_viewer:2007:sp3::::::
	cpe:2.3:a:microsoft:office:2016:::::mac::
	cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3::::::

History

No history.

Information

Published : 2018-08-15 17:29

Updated : 2023-12-10 12:44

NVD link : CVE-2018-8382

Mitre link : CVE-2018-8382

CVE.ORG link : CVE-2018-8382

JSON object : View

Products Affected

microsoft

excel_viewer
office_compatibility_pack
excel_2013_rt
office
excel

CWE

CWE-200

Exposure of Sensitive Information to an Unauthorized Actor

{"id": "CVE-2018-8382", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.5, "attackVector": "LOCAL", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N", "integrityImpact": "NONE", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}, "impactScore": 3.6, "exploitabilityScore": 1.8}]}, "published": "2018-08-15T17:29:07.737", "references": [{"url": "http://www.securityfocus.com/bid/105000", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1041463", "tags": ["Third Party Advisory", "VDB Entry"], "source": "secure@microsoft.com"}, {"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8382", "tags": ["Patch", "Vendor Advisory"], "source": "secure@microsoft.com"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-200"}]}], "descriptions": [{"lang": "en", "value": "An information disclosure vulnerability exists when Microsoft Excel improperly discloses the contents of its memory, aka \"Microsoft Excel Information Disclosure Vulnerability.\" This affects Microsoft Excel Viewer, Microsoft Office, Microsoft Excel."}, {"lang": "es", "value": "Existe una vulnerabilidad de divulgaci\u00f3n de informaci\u00f3n cuando Microsoft Excel no muestra correctamente los contenidos de su memoria. Esto tambi\u00e9n se conoce como \"Microsoft Excel Information Disclosure Vulnerability\". Esto afecta a Microsoft Excel Viewer, Microsoft Office y Microsoft Excel."}], "lastModified": "2018-10-12T17:44:24.487", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:excel:2010:sp2:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E36D981E-E56D-46C7-9486-FC691A75C497"}, {"criteria": "cpe:2.3:a:microsoft:excel:2013:sp1:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F564117D-450D-45C4-9688-AF35F630A8A7"}, {"criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "09BF0981-749E-470B-A7AC-95AD087797EF"}, {"criteria": "cpe:2.3:a:microsoft:excel:2016:*:*:*:click-to-run:*:*:*", "vulnerable": true, "matchCriteriaId": "14F42778-339E-4949-A43D-6E74FA9C0F43"}, {"criteria": "cpe:2.3:a:microsoft:excel_2013_rt:sp1:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "F5CFE1C2-891F-4A90-8912-82D2F2132A65"}, {"criteria": "cpe:2.3:a:microsoft:excel_viewer:2007:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "E4635DA5-27DA-43FF-92AC-A9F80218A2F0"}, {"criteria": "cpe:2.3:a:microsoft:office:2016:*:*:*:*:mac:*:*", "vulnerable": true, "matchCriteriaId": "AE116A39-963D-43E2-A21B-782271C4F63C"}, {"criteria": "cpe:2.3:a:microsoft:office_compatibility_pack:-:sp3:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "71AF058A-2E5D-4B11-88DB-8903C64B13C1"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}