CVE-2018-0878

LowCVSS 3.1/10Last modified Jun 17, 2026

Description

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how XML External Entities (XXE) are processed, aka "Windows Remote Assistance Information Disclosure Vulnerability".

Metrics

CVSS 3.1 3.1/10CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Weakness enumeration

CWE-611

Affected software

Vendor	Product	Versions
Microsoft Corporation	Windows Remote Assistance	Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709

References

http://www.securityfocus.com/bid/103230Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040519Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0878Patch, Vendor Advisory
https://www.exploit-db.com/exploits/44352/Third Party Advisory, VDB Entry
http://www.securityfocus.com/bid/103230Third Party Advisory, VDB Entry
http://www.securitytracker.com/id/1040519Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0878Patch, Vendor Advisory
https://www.exploit-db.com/exploits/44352/Third Party Advisory, VDB Entry

Timeline

Published: Mar 14, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-08797.5Microsoft Edge in Windows 10 1709 allows information disclosure, due to how Edge handles objects in memory, aka "Microsoft Edge Information CVE-2018-08807.0The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege CVE-2018-08817.0The Microsoft Video Control in Microsoft Windows Server 2008 R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Wind CVE-2018-08827.0The Desktop Bridge in Windows 10 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an elevation of privilege CVE-2018-08837.5Windows Shell in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 CVE-2018-08847.8Windows Scripting Host (WSH) in Windows 10 Gold, 1511, 1607, 1703 and 1709, Windows Server 2016 and Windows Server, version 1709 allows a se CVE-2018-08855.8The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows Server 2012 and R2, Windows CVE-2018-08867.0The Credential Security Support Provider protocol (CredSSP) in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and CVE-2018-08875.5An information disclosure vulnerability exists when the Windows kernel fails to properly initialize a memory address, aka "Windows Kernel In CVE-2018-08885.6The Microsoft Hyper-V Network Switch in 64-bit versions of Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1, Windows CVE-2018-08897.5Microsoft Edge in Windows 10 Gold, 1511, 1607, 1703, 1709, and Windows Server 2016 allows remote code execution, due to how the scripting en CVE-2018-08905.3A security feature bypass vulnerability exists when Active Directory incorrectly applies Network Isolation settings, aka "Active Directory S