CVE-2017-8707

EUVD-2017-17653

13.09.2017, 01:29

The Windows Hyper-V component on Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 8.1, Windows Server 2012 Gold and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allows an information disclosure vulnerability when it fails to properly validate input from an authenticated user on a guest operating system, aka Hyper-V Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8706, CVE-2017-8711, CVE-2017-8712, and CVE-2017-8713.

Provider	Type	Base Score	Atk. Vector	Atk. Complexity	Priv. Required	Vector
NIST	Primary	5.3 MEDIUM	LOCAL	HIGH	HIGH	CVSS:3.0/AV:L/AC:H/PR:H/UI:N/S:C/C:H/I:N/A:N

Base Score

CVSS 3.x

EPSS Score

Percentile: 86%

Affected Products (NVD)

Vendor	Product	Version
microsoft	windows_10	-
microsoft	windows_8.1	*
microsoft	windows_server_2008	*
microsoft	windows_server_2016	*

𝑥

= Vulnerable software versions

Windows Releases

Platform

Version

Windows 10

(x64)	KB4038781
1511 (x64)	KB4038783
1607 (x64)	KB4038782
1703 (x64)	KB4038788

Windows 8.1

(x64)

KB4038793

Windows Server 2008

Service Pack 2 (x64)	KB4039325
Service Pack 2 Server Core (x64)	KB4039325

Windows Server 2008 R2

Service Pack 1 (x64)	KB4038779
Service Pack 1 Server Core (x64)	KB4038779

Windows Server 2012

Server Core	KB4038799
Standard	KB4038799

Windows Server 2012 R2

Server Core	KB4038793
Standard	KB4038793

Windows Server 2016

Server Core	KB4038782
Standard	KB4038782

Common Weakness Enumeration

CWE-200 - Exposure of Sensitive Information to an Unauthorized Actor
The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

References

http://www.securityfocus.com/bid/100790

http://www.securitytracker.com/id/1039317

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8707

http://www.securityfocus.com/bid/100790

http://www.securitytracker.com/id/1039317

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8707