CVE-2018-8119

MediumCVSS 5.6/10Last modified Jun 17, 2026

Description

A spoofing vulnerability exists when the Azure IoT Device Provisioning AMQP Transport library improperly validates certificates over the AMQP protocol, aka "Azure IoT SDK Spoofing Vulnerability." This affects C# SDK, C SDK, Java SDK.

Metrics

CVSS 3.0 5.6/10CVSS:3.0/AV:N/AC:H/PR:N/UI:N/S:U/C:L/I:L/A:L

Weakness enumeration

CWE-295

Affected software

Vendor	Product	Versions
Microsoft	C# SDK	Azure IoT
Microsoft	C SDK	Azure IoT
Microsoft	Java SDK	Azure IoT

References

http://www.securityfocus.com/bid/104070Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119Patch, Vendor Advisory
https://tools.cisco.com/security/center/viewAlert.x?alertId=57754&vs_f=Alert%20RSS&vs_cat=Security%20Intelligence&vs_type=RSS&vs_p=Microsoft%20Azure%20IoT%20SDK%20AMQP%20Transport%20Library%20Spoofing%20Vulnerability&vs_k=1Third Party Advisory
http://www.securityfocus.com/bid/104070Third Party Advisory, VDB Entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8119Patch, Vendor Advisory

Timeline

Published: May 9, 2018
Last modified: Jun 17, 2026
NVD status: Modified

Related CVEs from 2018

CVE-2018-81207.0An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k CVE-2018-81214.7An information disclosure vulnerability exists when the Windows kernel improperly initializes objects in memory, aka "Windows Kernel Informa CVE-2018-81227.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scrip CVE-2018-81234.3An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Dis CVE-2018-81247.0An elevation of privilege vulnerability exists in Windows when the Win32k component fails to properly handle objects in memory, aka "Win32k CVE-2018-81257.5A remote code execution vulnerability exists when Microsoft Edge improperly accesses objects in memory, aka "Microsoft Edge Memory Corruptio CVE-2018-81268.8A security feature bypass vulnerability exists when Internet Explorer fails to validate User Mode Code Integrity (UMCI) policies, aka "Inter CVE-2018-81275.5An information disclosure vulnerability exists when the Windows kernel improperly handles objects in memory, aka "Windows Kernel Information CVE-2018-81287.5A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Microsoft Edge, aka "Scriptin CVE-2018-81295.3A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Featur CVE-2018-81307.5A remote code execution vulnerability exists in the way that the Chakra scripting engine handles objects in memory in Microsoft Edge, aka "C CVE-2018-81325.3A security feature bypass vulnerability exists in Windows which could allow an attacker to bypass Device Guard, aka "Windows Security Featur