« Volver al listado

CVE-2018-8172

Estado: ModificadaAlta (7.8)—💥 PoC

A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka "Visual Studio Remote Code Execution Vulnerability." This affects Microsoft Visual Studio, Expression Blend 4.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

💥 Exploits públicos

Hay código de explotación o plantillas de detección públicos. No es lo mismo que explotación activa confirmada (KEV), pero aumenta el riesgo: parchee con prioridad.

⚠️ Las pruebas de concepto de GitHub no están verificadas: algunas son falsas o contienen malware. No las ejecute nunca fuera de un laboratorio aislado.

Tecnologías afectadas (3)

Microsoft — Expression BlendMicrosoft — Visual StudioMicrosoft — Visual Studio 2017

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-8172",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 9.3,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:C/I:C/A:C",
          "authentication": "NONE",
          "integrityImpact": "COMPLETE",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "COMPLETE",
          "confidentialityImpact": "COMPLETE"
        },
        "acInsufInfo": false,
        "impactScore": 10,
        "baseSeverity": "HIGH",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": true
      }
    ],
    "cvssMetricV31": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.1",
          "baseScore": 7.8,
          "attackVector": "LOCAL",
          "baseSeverity": "HIGH",
          "vectorString": "CVSS:3.1/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H",
          "integrityImpact": "HIGH",
          "userInteraction": "REQUIRED",
          "attackComplexity": "LOW",
          "availabilityImpact": "HIGH",
          "privilegesRequired": "NONE",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 5.9,
        "exploitabilityScore": 1.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Visual Studio",
          "versions": [
            {
              "status": "affected",
              "version": "2010 Service Pack 1"
            },
            {
              "status": "affected",
              "version": "2012 Update 5"
            },
            {
              "status": "affected",
              "version": "2013 Update 5"
            },
            {
              "status": "affected",
              "version": "2015 Update 3"
            },
            {
              "status": "affected",
              "version": "2017"
            },
            {
              "status": "affected",
              "version": "2017 Version 15.7.5"
            },
            {
              "status": "affected",
              "version": "2017 Version 15.8 Preview"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Expression Blend 4",
          "versions": [
            {
              "status": "affected",
              "version": "Service Pack 3"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-07-11T00:29:00.367",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/104616",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securitytracker.com/id/1041253",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/104616",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securitytracker.com/id/1041253",
      "tags": [
        "Broken Link",
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8172",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "NVD-CWE-noinfo"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "A remote code execution vulnerability exists in Visual Studio software when the software does not check the source markup of a file for an unbuilt project, aka \"Visual Studio Remote Code Execution Vulnerability.\" This affects Microsoft Visual Studio, Expression Blend 4."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de ejecución remota de código en el software de Visual Studio cuando el software no comprueba el marcado de fuentes de un archivo para un proyecto sin implementar. Esto también se conoce como \"Visual Studio Remote Code Execution Vulnerability\". Esto afecta a Microsoft Visual Studio y Expression Blend 4."
    }
  ],
  "lastModified": "2026-06-17T02:04:23.960",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:expression_blend:2:sp2:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "8854E4AC-9D27-4DD7-8F95-038DE041F310"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:expression_blend:3:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "BCD59FF3-A586-4DCD-90DC-B084C46AC459"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:expression_blend:4:sp3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "E631F620-3093-469F-BEC9-D7EEAC424F89"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio:2010:sp1:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4DD0F743-9881-4934-944A-982F994FC595"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio:2012:update_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "28CC44DA-DF23-400D-9299-7DF3EECD89E9"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio:2013:update_5:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "4A820094-4660-4CFA-BAF1-ED4DBF45AD46"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio:2015:update3:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "62FE95C2-066B-491D-82BF-3EF173822B2F"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2017:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CDA983E6-A2DA-48BB-9874-14CF4B3AAE15"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:visual_studio_2017:15.7.5:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "F8018249-9F39-42A0-B17C-A3AF51D7D253"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}