# CVE-2018-8652: Windows Azure Pack Cross Site Scripting Vulnerability

CVE-2018-8652 is fixed in Windows Azure Pack Rollup 13.1 on 1 platform by KB4480788 (version ), released December 11, 2018. It is not reported as exploited. Patch Radar priority: High.

- Web page: https://patchblox.com/security/cve/CVE-2018-8652
- Priority: High
- CVSS: n/a (Important)
- EPSS: 0.0150
- CISA KEV: not listed
- Exploited (vendor report): no
- Publicly disclosed: no
- Published: Dec 11, 2018
- Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2018-8652

## Description

<p>A Cross-site Scripting (XSS) vulnerability exists when Windows Azure Pack does not properly sanitize user-provided input. An authenticated attacker could exploit the vulnerability by sending a specially crafted payload to the web interface, which will get executed in the context of the user every time a user visits the compromised page.</p> <p>The attacker who successfully exploited the vulnerability could then perform cross-site scripting attacks on affected systems and run script in the security context of the current user. The attacks could allow the attacker to read content that the attacker is not authorized to read, execute malicious code, and use the victim's identity to take actions on the site on behalf of the user, such as change permissions and delete content.</p> <p>The security update addresses the vulnerability by ensuring that Windows Azure Pack sanitizes user inputs.</p>

## Where it's fixed

| Platform | Product | Fixed in | Fix | Released |
|---|---|---|---|---|
| Microsoft | Windows Azure Pack Rollup 13.1 |  | [KB4480788](https://patchblox.com/security/data/fix/microsoft/kb4480788.md) | Dec 11, 2018 |

---

Data as of 2026-11-07T06:34:28Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo