CVE-2015-2368 - Untrusted search path vulnerability in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows

CVE-2015-2368

Summary

Untrusted search path vulnerability in Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows Server 2012 R2, and Windows RT 8.1 allows local users to gain privileges via a Trojan horse DLL in the current working directory, aka "Windows DLL Remote Code Execution Vulnerability." <a href="http://cwe.mitre.org/data/definitions/426.html">CWE-426: Untrusted Search Path</a>

References

Vulnerable Configurations

cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_7:-:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2008:r2:sp1:*:*:*:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:datacenter:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:datacenter:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:essentials:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:essentials:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:standard:*:*:*
cpe:2.3:o:microsoft:windows_server_2012:r2:*:*:*:standard:*:*:*

CVSS

Base:	6.9 (as of 08-05-2019 - 22:03)
Impact:
Exploitability:

CWE

NVD-CWE-Other

CAPEC

Access

Vector	Complexity	Authentication
LOCAL	MEDIUM	NONE

Impact

Confidentiality	Integrity	Availability
COMPLETE	COMPLETE	COMPLETE

cvss-vector via4

AV:L/AC:M/Au:N/C:C/I:C/A:C

msbulletin via4

bulletin_id	MS15-069
bulletin_url
date	2015-07-14T00:00:00
impact	Remote Code Execution
knowledgebase_id	3072631
knowledgebase_url
severity	Important
title	Vulnerabilities in Windows Could Allow Remote Code Execution

refmap via4

sectrack

1032898

Last major update

08-05-2019 - 22:03

Published

14-07-2015 - 21:59

Last modified

08-05-2019 - 22:03