CVE-2014-0315: microsoft windows_7 Untrusted Search Path

Vulnerability summary

CVE-2014-0315 is a medium (CVSS 6.9) Untrusted Search Path vulnerability in microsoft windows_7. EPSS estimates a 14.62% chance of exploitation in the next 30 days, higher than 96.6% of scored vulnerabilities.

Timeline

1. 08-04-2014
   PublishedVulnerability first disclosed.
2. 06-08-2024
   Last modifiedVulnerability information updated.

Description

Untrusted search path vulnerability in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, Windows 7 SP1, Windows 8, Windows 8.1, Windows Server 2012 Gold and R2, and Windows RT Gold and 8.1 allows local users to gain privileges via a Trojan horse cmd.exe file in the current working directory, as demonstrated by a directory that contains a .bat or .cmd file, aka "Windows File Handling Vulnerability."

• CWE-426Untrusted Search PathThe product searches for critical resources using an externally-supplied search path that can point to resources that are not under the product's direct control.