CVE-2004-0213

7.8 HIGH
Published: August 06, 2004 Modified: April 16, 2026
View on NVD

Description

Utility Manager in Windows 2000 launches winhlp32.exe while Utility Manager is running with raised privileges, which allows local users to gain system privileges via a "Shatter" style attack that sends a Windows message to cause Utility Manager to launch winhlp32 by directly accessing the context sensitive help and bypassing the GUI, then sending another message to winhlp32 in order to open a user-selected file, a different vulnerability than CVE-2003-0908.

AI Explanation

Get an AI-powered plain-language explanation of this vulnerability and remediation steps.

Login to generate AI explanation

CVSS v3.x Details

0.0 Low Medium High Critical 10.0
Vector String
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H

References to Advisories, Solutions, and Tools

Patch Vendor Advisory Exploit Third Party Advisory
http://marc.info/?l=bugtraq&m=108975382413405&w=2
Source: cve@mitre.org
Mailing List
http://www.kb.cert.org/vuls/id/868580
Source: cve@mitre.org
Third Party Advisory US Government Resource
http://www.us-cert.gov/cas/techalerts/TA04-196A.html
Source: cve@mitre.org
Broken Link Patch Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-019
Source: cve@mitre.org
Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16592
Source: cve@mitre.org
Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2495
Source: cve@mitre.org
Broken Link
http://marc.info/?l=bugtraq&m=108975382413405&w=2
Source: af854a3a-2127-422b-91ae-364da2661108
Mailing List
http://www.kb.cert.org/vuls/id/868580
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory US Government Resource
http://www.us-cert.gov/cas/techalerts/TA04-196A.html
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link Patch Third Party Advisory US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-019
Source: af854a3a-2127-422b-91ae-364da2661108
Patch Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/16592
Source: af854a3a-2127-422b-91ae-364da2661108
Third Party Advisory VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2495
Source: af854a3a-2127-422b-91ae-364da2661108
Broken Link

12 reference(s) from NVD

Quick Stats

CVSS v3 Score
7.8 / 10.0
EPSS (Exploit Probability)
2.4%
85th percentile
Exploitation Status
Not in CISA KEV

Weaknesses (CWE)

CWE-306

Affected Vendors

microsoft

Related CVEs

CVE-2026-40962 4.9
CVE-2026-40505 3.3
CVE-2026-40504 9.8
CVE-2026-3299 6.4
CVE-2026-40960 8.1