CVE-2018-8414

{"containers": {"cna": {"affected": [{"product": "Windows 10 Servers", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "version 1709 (Server Core Installation)"}, {"status": "affected", "version": "version 1803 (Server Core Installation)"}]}, {"product": "Windows 10", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "Version 1703 for 32-bit Systems"}, {"status": "affected", "version": "Version 1703 for x64-based Systems"}, {"status": "affected", "version": "Version 1709 for 32-bit Systems"}, {"status": "affected", "version": "Version 1709 for x64-based Systems"}, {"status": "affected", "version": "Version 1803 for 32-bit Systems"}, {"status": "affected", "version": "Version 1803 for x64-based Systems"}]}], "datePublic": "2018-08-14T00:00:00.000Z", "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka \"Windows Shell Remote Code Execution Vulnerability.\" This affects Windows 10 Servers, Windows 10."}], "problemTypes": [{"descriptions": [{"description": "Remote Code Execution", "lang": "en", "type": "text"}]}], "providerMetadata": {"dateUpdated": "2018-08-16T09:57:01.000Z", "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft"}, "references": [{"tags": ["x_refsource_CONFIRM"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414"}, {"name": "105016", "tags": ["vdb-entry", "x_refsource_BID"], "url": "http://www.securityfocus.com/bid/105016"}, {"name": "1041458", "tags": ["vdb-entry", "x_refsource_SECTRACK"], "url": "http://www.securitytracker.com/id/1041458"}], "x_legacyV4Record": {"CVE_data_meta": {"ASSIGNER": "secure@microsoft.com", "ID": "CVE-2018-8414", "STATE": "PUBLIC"}, "affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"product_name": "Windows 10 Servers", "version": {"version_data": [{"version_value": "version 1709 (Server Core Installation)"}, {"version_value": "version 1803 (Server Core Installation)"}]}}, {"product_name": "Windows 10", "version": {"version_data": [{"version_value": "Version 1703 for 32-bit Systems"}, {"version_value": "Version 1703 for x64-based Systems"}, {"version_value": "Version 1709 for 32-bit Systems"}, {"version_value": "Version 1709 for x64-based Systems"}, {"version_value": "Version 1803 for 32-bit Systems"}, {"version_value": "Version 1803 for x64-based Systems"}]}}]}, "vendor_name": "Microsoft"}]}}, "data_format": "MITRE", "data_type": "CVE", "data_version": "4.0", "description": {"description_data": [{"lang": "eng", "value": "A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka \"Windows Shell Remote Code Execution Vulnerability.\" This affects Windows 10 Servers, Windows 10."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote Code Execution"}]}]}, "references": {"reference_data": [{"name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414", "refsource": "CONFIRM", "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414"}, {"name": "105016", "refsource": "BID", "url": "http://www.securityfocus.com/bid/105016"}, {"name": "1041458", "refsource": "SECTRACK", "url": "http://www.securitytracker.com/id/1041458"}]}}}, "adp": [{"providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:54:36.389Z"}, "title": "CVE Program Container", "references": [{"tags": ["x_refsource_CONFIRM", "x_transferred"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414"}, {"name": "105016", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"], "url": "http://www.securityfocus.com/bid/105016"}, {"name": "1041458", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"], "url": "http://www.securitytracker.com/id/1041458"}]}, {"metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2018-8414", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-07T16:24:52.970463Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8414"}}}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8414", "tags": ["government-resource"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "timeline": [{"time": "2022-03-25T00:00:00.000Z", "lang": "en", "value": "CVE-2018-8414 added to CISA KEV"}], "title": "CISA ADP Vulnrichment", "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-10-21T23:45:48.521Z"}}]}, "cveMetadata": {"assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "assignerShortName": "microsoft", "cveId": "CVE-2018-8414", "datePublished": "2018-08-15T17:00:00.000Z", "dateReserved": "2018-03-14T00:00:00.000Z", "dateUpdated": "2025-10-21T23:45:48.521Z", "state": "PUBLISHED"}, "dataType": "CVE_RECORD", "dataVersion": "5.1"}

{"dataType": "CVE_RECORD", "containers": {"adp": [{"title": "CVE Program Container", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414", "tags": ["x_refsource_CONFIRM", "x_transferred"]}, {"url": "http://www.securityfocus.com/bid/105016", "name": "105016", "tags": ["vdb-entry", "x_refsource_BID", "x_transferred"]}, {"url": "http://www.securitytracker.com/id/1041458", "name": "1041458", "tags": ["vdb-entry", "x_refsource_SECTRACK", "x_transferred"]}], "providerMetadata": {"orgId": "af854a3a-2127-422b-91ae-364da2661108", "shortName": "CVE", "dateUpdated": "2024-08-05T06:54:36.389Z"}}, {"title": "CISA ADP Vulnrichment", "metrics": [{"cvssV3_1": {"scope": "UNCHANGED", "version": "3.1", "baseScore": 8.8, "attackVector": "NETWORK", "baseSeverity": "HIGH", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "LOW", "availabilityImpact": "HIGH", "privilegesRequired": "NONE", "confidentialityImpact": "HIGH"}}, {"other": {"type": "ssvc", "content": {"id": "CVE-2018-8414", "role": "CISA Coordinator", "options": [{"Exploitation": "active"}, {"Automatable": "no"}, {"Technical Impact": "total"}], "version": "2.0.3", "timestamp": "2025-02-07T16:24:52.970463Z"}}}, {"other": {"type": "kev", "content": {"dateAdded": "2022-03-25", "reference": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8414"}}}], "timeline": [{"lang": "en", "time": "2022-03-25T00:00:00.000Z", "value": "CVE-2018-8414 added to CISA KEV"}], "references": [{"url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8414", "tags": ["government-resource"]}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "CWE", "cweId": "CWE-20", "description": "CWE-20 Improper Input Validation"}]}], "providerMetadata": {"orgId": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "shortName": "CISA-ADP", "dateUpdated": "2025-02-07T16:26:15.675Z"}}], "cna": {"affected": [{"vendor": "Microsoft", "product": "Windows 10 Servers", "versions": [{"status": "affected", "version": "version 1709 (Server Core Installation)"}, {"status": "affected", "version": "version 1803 (Server Core Installation)"}]}, {"vendor": "Microsoft", "product": "Windows 10", "versions": [{"status": "affected", "version": "Version 1703 for 32-bit Systems"}, {"status": "affected", "version": "Version 1703 for x64-based Systems"}, {"status": "affected", "version": "Version 1709 for 32-bit Systems"}, {"status": "affected", "version": "Version 1709 for x64-based Systems"}, {"status": "affected", "version": "Version 1803 for 32-bit Systems"}, {"status": "affected", "version": "Version 1803 for x64-based Systems"}]}], "datePublic": "2018-08-14T00:00:00.000Z", "references": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414", "tags": ["x_refsource_CONFIRM"]}, {"url": "http://www.securityfocus.com/bid/105016", "name": "105016", "tags": ["vdb-entry", "x_refsource_BID"]}, {"url": "http://www.securitytracker.com/id/1041458", "name": "1041458", "tags": ["vdb-entry", "x_refsource_SECTRACK"]}], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka \"Windows Shell Remote Code Execution Vulnerability.\" This affects Windows 10 Servers, Windows 10."}], "problemTypes": [{"descriptions": [{"lang": "en", "type": "text", "description": "Remote Code Execution"}]}], "providerMetadata": {"orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "shortName": "microsoft", "dateUpdated": "2018-08-16T09:57:01.000Z"}, "x_legacyV4Record": {"affects": {"vendor": {"vendor_data": [{"product": {"product_data": [{"version": {"version_data": [{"version_value": "version 1709 (Server Core Installation)"}, {"version_value": "version 1803 (Server Core Installation)"}]}, "product_name": "Windows 10 Servers"}, {"version": {"version_data": [{"version_value": "Version 1703 for 32-bit Systems"}, {"version_value": "Version 1703 for x64-based Systems"}, {"version_value": "Version 1709 for 32-bit Systems"}, {"version_value": "Version 1709 for x64-based Systems"}, {"version_value": "Version 1803 for 32-bit Systems"}, {"version_value": "Version 1803 for x64-based Systems"}]}, "product_name": "Windows 10"}]}, "vendor_name": "Microsoft"}]}}, "data_type": "CVE", "references": {"reference_data": [{"url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414", "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414", "refsource": "CONFIRM"}, {"url": "http://www.securityfocus.com/bid/105016", "name": "105016", "refsource": "BID"}, {"url": "http://www.securitytracker.com/id/1041458", "name": "1041458", "refsource": "SECTRACK"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "eng", "value": "A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka \"Windows Shell Remote Code Execution Vulnerability.\" This affects Windows 10 Servers, Windows 10."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "eng", "value": "Remote Code Execution"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2018-8414", "STATE": "PUBLIC", "ASSIGNER": "secure@microsoft.com"}}}}, "cveMetadata": {"cveId": "CVE-2018-8414", "state": "PUBLISHED", "dateUpdated": "2025-10-21T23:45:48.521Z", "dateReserved": "2018-03-14T00:00:00.000Z", "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8", "datePublished": "2018-08-15T17:00:00.000Z", "assignerShortName": "microsoft"}, "dataVersion": "5.1"}

{"affected": [{"affectedData": [{"product": "Windows 10 Servers", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "version 1709 (Server Core Installation)"}, {"status": "affected", "version": "version 1803 (Server Core Installation)"}]}, {"product": "Windows 10", "vendor": "Microsoft", "versions": [{"status": "affected", "version": "Version 1703 for 32-bit Systems"}, {"status": "affected", "version": "Version 1703 for x64-based Systems"}, {"status": "affected", "version": "Version 1709 for 32-bit Systems"}, {"status": "affected", "version": "Version 1709 for x64-based Systems"}, {"status": "affected", "version": "Version 1803 for 32-bit Systems"}, {"status": "affected", "version": "Version 1803 for x64-based Systems"}]}], "source": "secure@microsoft.com"}], "cisaActionDue": "2022-04-15", "cisaExploitAdd": "2022-03-25", "cisaRequiredAction": "Apply updates per vendor instructions.", "cisaVulnerabilityName": "Microsoft Windows Shell Remote Code Execution Vulnerability", "configurations": [{"nodes": [{"cpeMatch": [{"criteria": "cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x64:*", "matchCriteriaId": "B98DB3FF-CC3B-4E9F-A9CC-EC4C89AF3B31", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1703:-:*:*:*:*:*:x86:*", "matchCriteriaId": "8733BF37-7BF2-409D-9452-DA8A92DA1124", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x64:*", "matchCriteriaId": "469F95D3-ABBB-4F1A-A000-BE0F6BD60FF6", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1709:-:*:*:*:*:*:x86:*", "matchCriteriaId": "D76003FB-EE99-4D8E-B6A0-B13C2041E5A0", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x64:*", "matchCriteriaId": "D82F8AF7-ED01-4649-849E-F248F0E02384", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_10_1803:-:*:*:*:*:*:x86:*", "matchCriteriaId": "C1CFB53B-B17B-47BD-BAC1-C6C5D168FFB6", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_1709:-:*:*:*:*:*:x64:*", "matchCriteriaId": "9EFB4440-2B6B-486F-94D4-7D9C80301E51", "vulnerable": true}, {"criteria": "cpe:2.3:o:microsoft:windows_server_1803:-:*:*:*:*:*:x64:*", "matchCriteriaId": "FD3218D1-BE39-4CEB-A88F-E715B722862B", "vulnerable": true}], "negate": false, "operator": "OR"}]}], "cveTags": [], "descriptions": [{"lang": "en", "value": "A remote code execution vulnerability exists when the Windows Shell does not properly validate file paths, aka \"Windows Shell Remote Code Execution Vulnerability.\" This affects Windows 10 Servers, Windows 10."}, {"lang": "es", "value": "Existe una vulnerabilidad de ejecuci\u00f3n remota de c\u00f3digo cuando Windows Shell no valida incorrectamente las rutas de archivo. Esto tambi\u00e9n se conoce como \"Windows Shell Remote Code Execution Vulnerability\". Esto afecta a Windows 10 Servers y Windows 10."}], "id": "CVE-2018-8414", "lastModified": "2026-06-17T02:04:48.927", "metrics": {"cvssMetricV2": [{"acInsufInfo": false, "baseSeverity": "HIGH", "cvssData": {"accessComplexity": "MEDIUM", "accessVector": "NETWORK", "authentication": "NONE", "availabilityImpact": "COMPLETE", "baseScore": 9.3, "confidentialityImpact": "COMPLETE", "integrityImpact": "COMPLETE", "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C", "version": "2.0"}, "exploitabilityScore": 8.6, "impactScore": 10.0, "obtainAllPrivilege": false, "obtainOtherPrivilege": false, "obtainUserPrivilege": false, "source": "nvd@nist.gov", "type": "Primary", "userInteractionRequired": true}], "cvssMetricV31": [{"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "nvd@nist.gov", "type": "Primary"}, {"cvssData": {"attackComplexity": "LOW", "attackVector": "NETWORK", "availabilityImpact": "HIGH", "baseScore": 8.8, "baseSeverity": "HIGH", "confidentialityImpact": "HIGH", "integrityImpact": "HIGH", "privilegesRequired": "NONE", "scope": "UNCHANGED", "userInteraction": "REQUIRED", "vectorString": "CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H", "version": "3.1"}, "exploitabilityScore": 2.8, "impactScore": 5.9, "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}], "ssvcV203": [{"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "ssvcData": {"id": "CVE-2018-8414", "options": [{"exploitation": "active"}, {"automatable": "no"}, {"technicalImpact": "total"}], "role": "CISA Coordinator", "timestamp": "2025-02-07T16:24:52.970463Z", "version": "2.0.3"}}]}, "published": "2018-08-15T17:29:10.393", "references": [{"source": "secure@microsoft.com", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105016"}, {"source": "secure@microsoft.com", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041458"}, {"source": "secure@microsoft.com", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securityfocus.com/bid/105016"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Broken Link", "Third Party Advisory", "VDB Entry"], "url": "http://www.securitytracker.com/id/1041458"}, {"source": "af854a3a-2127-422b-91ae-364da2661108", "tags": ["Patch", "Vendor Advisory"], "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8414"}, {"source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "tags": ["US Government Resource"], "url": "https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8414"}], "sourceIdentifier": "secure@microsoft.com", "vulnStatus": "Analyzed", "weaknesses": [{"description": [{"lang": "en", "value": "CWE-20"}], "source": "nvd@nist.gov", "type": "Primary"}, {"description": [{"lang": "en", "value": "CWE-20"}], "source": "134c704f-9b21-4f2e-91b3-4a467353bcc0", "type": "Secondary"}]}

{}

{}