CVE-2018-0878

State: Published
Severity: 3.1 Low
Published: Mar 14, 2018
Updated: Apr 4, 2025
Reserved: Dec 1, 2017

Description

Windows Remote Assistance in Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709 allows an information disclosure vulnerability due to how XML External Entities (XXE) are processed, aka "Windows Remote Assistance Information Disclosure Vulnerability".

Scores

CVSS	Score	Vector	Source
3.1	3.1 Low	CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N	CISA-ADP

Weaknesses

CWE-611 Improper Restriction of XML External Entity Reference

Affected Products

Product	Versions
Windows Remote AssistanceMicrosoft Corporation	Microsoft Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8.1 and RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, 1703, and 1709, Windows Server 2016 and Windows Server, version 1709Affected

References

1040519vdb-entry
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0878
44352exploit
103230vdb-entry

Every record here comes from the CVE Program’s CVE List. © 1999–2026 The MITRE Corporation. CVE is a registered trademark of The MITRE Corporation. The records are reproduced under the CVE Program terms of use.