Remote Code Execution Vulnerability in Windows Shell Affecting Microsoft Products
CVE-2017-8699

7HIGH

Key Information:

Vendor
Microsoft
Status
Windows Shell
Vendor
CVE Published:
13 September 2017

Summary

The Windows Shell component in several versions of Microsoft Windows allows an attacker to execute arbitrary code within the context of the current user account. This vulnerability stems from improper validation of file copy destinations, enabling malicious actors to exploit the flaw to escalate their privileges and perform unauthorized actions on affected systems. Operating systems impacted include various iterations of Windows, presenting a significant risk if not updated or mitigated effectively.

Affected Version(s)

Windows Shell Microsoft Windows 7 SP1, Windows Server 2008 and R2 SP1, Windows 8.1 and Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016.

References

http://www.securityfocus.com/bid/100783
vdb-entryx_refsource_BID
http://www.securitytracker.com/id/1039331
vdb-entryx_refsource_SECTRACK
https://portal.msrc.microsoft.com/en-US/security-guidance...
x_refsource_CONFIRM

EPSS Score

74% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
High
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • Vulnerability published

  • Vulnerability Reserved

.