« Volver al listado

CVE-2018-8558

Estado: ModificadaMedia (6.5)—

An information disclosure vulnerability exists when Microsoft Outlook fails to respect "Default link type" settings configured via the SharePoint Online Admin Center, aka "Microsoft Outlook Information Disclosure Vulnerability." This affects Office 365 ProPlus, Microsoft Office. This CVE ID is unique from CVE-2018-8579.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (2)

Microsoft — OfficeMicrosoft — Office 365 Proplus

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2018-8558",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 4,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:L/Au:S/C:P/I:N/A:N",
          "authentication": "SINGLE",
          "integrityImpact": "NONE",
          "accessComplexity": "LOW",
          "availabilityImpact": "NONE",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 2.9,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8,
        "obtainUserPrivilege": false,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ],
    "cvssMetricV30": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "scope": "UNCHANGED",
          "version": "3.0",
          "baseScore": 6.5,
          "attackVector": "NETWORK",
          "baseSeverity": "MEDIUM",
          "vectorString": "CVSS:3.0/AV:N/AC:L/PR:L/UI:N/S:U/C:H/I:N/A:N",
          "integrityImpact": "NONE",
          "userInteraction": "NONE",
          "attackComplexity": "LOW",
          "availabilityImpact": "NONE",
          "privilegesRequired": "LOW",
          "confidentialityImpact": "HIGH"
        },
        "impactScore": 3.6,
        "exploitabilityScore": 2.8
      }
    ]
  },
  "affected": [
    {
      "source": "secure@microsoft.com",
      "affectedData": [
        {
          "vendor": "Microsoft",
          "product": "Microsoft Office",
          "versions": [
            {
              "status": "affected",
              "version": "2019 for 32-bit editions"
            },
            {
              "status": "affected",
              "version": "2019 for 64-bit editions"
            }
          ]
        },
        {
          "vendor": "Microsoft",
          "product": "Office",
          "versions": [
            {
              "status": "affected",
              "version": "365 ProPlus for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "365 ProPlus for 64-bit Systems"
            }
          ]
        }
      ]
    }
  ],
  "published": "2018-11-14T01:29:01.363",
  "references": [
    {
      "url": "http://www.securityfocus.com/bid/105826",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8558",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "secure@microsoft.com"
    },
    {
      "url": "http://www.securityfocus.com/bid/105826",
      "tags": [
        "Third Party Advisory",
        "VDB Entry"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8558",
      "tags": [
        "Patch",
        "Vendor Advisory"
      ],
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-200"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "An information disclosure vulnerability exists when Microsoft Outlook fails to respect \"Default link type\" settings configured via the SharePoint Online Admin Center, aka \"Microsoft Outlook Information Disclosure Vulnerability.\" This affects Office 365 ProPlus, Microsoft Office. This CVE ID is unique from CVE-2018-8579."
    },
    {
      "lang": "es",
      "value": "Existe una vulnerabilidad de divulgación de información cuando Microsoft Outlook no respeta la opción \"Default link type\" configurada mediante el centro de administración online de SharePoint. Esto también se conoce como \"Microsoft Outlook Information Disclosure Vulnerability\". Esto afecta a Office 365 ProPlus y Microsoft Office. El ID de este CVE es diferente de CVE-2018-8579."
    }
  ],
  "lastModified": "2026-06-17T02:05:05.980",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:microsoft:office:2019:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "FF177984-A906-43FA-BF60-298133FBBD6B"
            },
            {
              "criteria": "cpe:2.3:a:microsoft:office_365_proplus:-:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "CA035812-F35A-43F1-9A8D-EE02201AA10A"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "secure@microsoft.com"
}