CVE-2018-0593

HighCVSS 7.8/10Last modified Jun 17, 2026

Description

Untrusted search path vulnerability in the installer of Microsoft OneDrive allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directory.

Metrics

CVSS 3.0 7.8/10CVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weakness enumeration

CWE-426

Affected software

Vendor	Product	Versions
Microsoft	The installer of Microsoft OneDrive	unspecified

References

http://jvn.jp/en/jp/JVN91151862/index.htmlThird Party Advisory
http://www.securityfocus.com/bid/104563Third Party Advisory, VDB Entry
https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/Vendor Advisory
http://jvn.jp/en/jp/JVN91151862/index.htmlThird Party Advisory
http://www.securityfocus.com/bid/104563Third Party Advisory, VDB Entry
https://blogs.technet.microsoft.com/srd/2018/04/04/triaging-a-dll-planting-vulnerability/Vendor Advisory

Timeline

Published: Jun 26, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-05947.8Untrusted search path vulnerability in Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an unspecified dire CVE-2018-05957.8Untrusted search path vulnerability in the installer of Skype for Windows allows an attacker to gain privileges via a Trojan horse DLL in an CVE-2018-05967.8Untrusted search path vulnerability in the installer of Visual Studio Community allows an attacker to gain privileges via a Trojan horse DLL CVE-2018-05977.8Untrusted search path vulnerability in the installer of Visual Studio Code allows an attacker to gain privileges via a Trojan horse DLL in a CVE-2018-05987.8Untrusted search path vulnerability in Self-extracting archive files created by IExpress bundled with Microsoft Windows allows an attacker t CVE-2018-05997.8Untrusted search path vulnerability in the installer of Visual C++ Redistributable allows an attacker to gain privileges via a Trojan horse CVE-2018-06007.8Untrusted search path vulnerability in the installer of PlayMemories Home for Windows ver.5.5.01 and earlier allows an attacker to gain priv CVE-2018-06017.8Untrusted search path vulnerability in axpdfium v0.01 allows an attacker to gain privileges via a Trojan horse DLL in an unspecified directo CVE-2018-06026.1Cross-site scripting vulnerability in Email Subscribers & Newsletters versions prior to 3.5.0 allows remote attackers to inject arbitrary we CVE-2018-06036.1Cross-site scripting vulnerability in Site Reviews versions prior to 2.15.3 allows remote attackers to inject arbitrary web script or HTML v CVE-2018-06047.2Pixelpost v1.7.3 and earlier allows remote code execution via unspecified vectors.CVE-2018-06056.1Cross-site scripting vulnerability in Pixelpost v1.7.3 and earlier allows remote attackers to inject arbitrary web script or HTML via unspec