Vulnerabilities > CVE-2018-8502 - Unspecified vulnerability in Microsoft Excel, Office and Office 365 Proplus
Attack vector
NETWORK Attack complexity
LOW Privileges required
NONE Confidentiality impact
HIGH Integrity impact
HIGH Availability impact
HIGH Summary
A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View, aka "Microsoft Excel Remote Code Execution Vulnerability." This affects Office 365 ProPlus, Microsoft Office, Microsoft Excel.
Vulnerable Configurations
| Part | Description | Count |
|---|---|---|
| Application | 10 |
Nessus
NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS18_OCT_OFFICE.NASL description The Microsoft Office Products are missing security updates. It is, therefore, affected by multiple vulnerabilities : - A remote code execution vulnerability exists in Microsoft Word software when the software fails to properly handle objects in Protected View. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8504) - A remote code execution vulnerability exists in Microsoft PowerPoint software when the software fails to properly handle objects in Protected View. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8501) - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8502) last seen 2020-06-01 modified 2020-06-02 plugin id 118010 published 2018-10-09 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118010 title Security Updates for Microsoft Office Products (October 2018) NASL family Windows : Microsoft Bulletins NASL id SMB_NT_MS18_OCT_EXCEL.NASL description The Microsoft Excel Products are missing a security update. It is, therefore, affected by the following vulnerability : - A remote code execution vulnerability exists in Microsoft Excel software when the software fails to properly handle objects in Protected View. An attacker who successfully exploited the vulnerability could run arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of the affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights. (CVE-2018-8502) last seen 2020-06-01 modified 2020-06-02 plugin id 118007 published 2018-10-09 reporter This script is Copyright (C) 2018-2019 and is owned by Tenable, Inc. or an Affiliate thereof. source https://www.tenable.com/plugins/nessus/118007 title Security Updates for Microsoft Excel Products (October 2018)
References
- http://www.securityfocus.com/bid/105498
- http://www.securityfocus.com/bid/105498
- http://www.securitytracker.com/id/1041839
- http://www.securitytracker.com/id/1041839
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8502
- https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8502