CVE-2008-1456

2008-08-1312:42:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2008-1456

array index

vulnerability

microsoft windows

remote execution

authenticated users

crafted event subscription

7 High

AI Score

Confidence

Low

9 High

CVSS2

Access Vector

NETWORK

Access Complexity

LOW

Authentication

SINGLE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:L/Au:S/C:C/I:C/A:C

0.245 Low

EPSS

Percentile

96.6%

JSON

Array index vulnerability in the Event System in Microsoft Windows 2000 SP4, XP SP2 and SP3, Server 2003 SP1 and SP2, Vista Gold and SP1, and Server 2008 allows remote authenticated users to execute arbitrary code via a crafted event subscription request that is used to access an array of function pointers.

CPENameOperatorVersion
microsoft:windows_xpmicrosoft windows xpeq*
microsoft:windows_2000microsoft windows 2000eq*
microsoft:windows_vistamicrosoft windows vistaeq-
microsoft:windows-ntmicrosoft windows-nteqxp
microsoft:windows-ntmicrosoft windows-nteq2008
microsoft:windows_2003_servermicrosoft windows 2003 servereq*
microsoft:windows-ntmicrosoft windows-nteqvista

CPE	Name	Operator	Version
microsoft:windows_xp	microsoft windows xp	eq	*
microsoft:windows_2000	microsoft windows 2000	eq	*
microsoft:windows_vista	microsoft windows vista	eq	-
microsoft:windows-nt	microsoft windows-nt	eq	xp
microsoft:windows-nt	microsoft windows-nt	eq	2008
microsoft:windows_2003_server	microsoft windows 2003 server	eq	*
microsoft:windows-nt	microsoft windows-nt	eq	vista