{"api_version":"1","generated_at":"2026-07-23T08:06:02+00:00","cve":"CVE-2016-10717","urls":{"html":"https://cve.report/CVE-2016-10717","api":"https://cve.report/api/cve/CVE-2016-10717.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2016-10717","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2016-10717"},"summary":{"title":"CVE-2016-10717","description":"A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP.","state":"PUBLIC","assigner":"cve@mitre.org","published_at":"2018-03-21 21:29:00","updated_at":"2018-04-18 13:22:00"},"problem_types":["CWE-254"],"metrics":[],"references":[{"url":"https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/","name":"https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/","refsource":"MISC","tags":["Vendor Advisory"],"title":"Malwarebytes Hall of Fame - Malwarebytes News - Malwarebytes Forums","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt","name":"https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"mbam-exclusions-poc-/mbam-whitelist-poc.txt at master · mspaling/mbam-exclusions-poc- · GitHub","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://github.com/mspaling/mbam-exclusions-poc-","name":"https://github.com/mspaling/mbam-exclusions-poc-","refsource":"MISC","tags":["Exploit","Third Party Advisory"],"title":"GitHub - mspaling/mbam-exclusions-poc-: Proof of concept python file that will overwrite a valid exclusions.dat with a crafted exclusions.dat which permits malicious files to run.","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.youtube.com/watch?v=LF5ic5nOoUY","name":"https://www.youtube.com/watch?v=LF5ic5nOoUY","refsource":"MISC","tags":["Third Party Advisory"],"title":"You Don't See Me - Abusing Whitelists to Hide and Run Malware - Richo Healy, Michael Spaling - YouTube","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytube.net/video/16690","name":"http://www.securitytube.net/video/16690","refsource":"MISC","tags":["Third Party Advisory"],"title":"Bsideslv 2016 -  You Don't See Me - Abusing Whitelists To Hide And Run Malware - Michael Spaling","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2016-10717","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2016-10717","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2016","cve_id":"10717","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"malwarebytes","cpe5":"malwarebytes_anti-malware","cpe6":"2.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"consumer","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2016","cve_id":"10717","vulnerable":"1","versionEndIncluding":"1","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"malwarebytes","cpe5":"malwarebytes_anti-malware","cpe6":"2.2.1","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"consumer","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2016-10717","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"https://www.youtube.com/watch?v=LF5ic5nOoUY","refsource":"MISC","url":"https://www.youtube.com/watch?v=LF5ic5nOoUY"},{"name":"http://www.securitytube.net/video/16690","refsource":"MISC","url":"http://www.securitytube.net/video/16690"},{"name":"https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt","refsource":"MISC","url":"https://github.com/mspaling/mbam-exclusions-poc-/blob/master/mbam-whitelist-poc.txt"},{"name":"https://github.com/mspaling/mbam-exclusions-poc-","refsource":"MISC","url":"https://github.com/mspaling/mbam-exclusions-poc-"},{"name":"https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/","refsource":"MISC","url":"https://forums.malwarebytes.com/topic/158251-malwarebytes-hall-of-fame/"}]}},"nvd":{"publishedDate":"2018-03-21 21:29:00","lastModifiedDate":"2018-04-18 13:22:00","problem_types":["CWE-254"],"metrics":{"baseMetricV3":{"cvssV3":{"version":"3.0","vectorString":"CVSS:3.0/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H","attackVector":"LOCAL","attackComplexity":"LOW","privilegesRequired":"LOW","userInteraction":"NONE","scope":"UNCHANGED","confidentialityImpact":"HIGH","integrityImpact":"HIGH","availabilityImpact":"HIGH","baseScore":7.8,"baseSeverity":"HIGH"},"exploitabilityScore":1.8,"impactScore":5.9},"baseMetricV2":{"cvssV2":{"version":"2.0","vectorString":"AV:L/AC:L/Au:N/C:P/I:P/A:P","accessVector":"LOCAL","accessComplexity":"LOW","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL","baseScore":4.6},"severity":"MEDIUM","exploitabilityScore":3.9,"impactScore":6.4,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":false}},"configurations":{"CVE_data_version":"4.0","nodes":[{"operator":"OR","children":[],"cpe_match":[{"vulnerable":true,"cpe23Uri":"cpe:2.3:a:malwarebytes:malwarebytes_anti-malware:2.2.1:*:*:*:consumer:*:*:*","cpe_name":[]}]}]}},"legacy_mitre":{"record":{"CveYear":"2016","CveId":"10717","Ordinal":"125259","Title":"CVE-2016-10717","CVE":"CVE-2016-10717","Year":"2016"},"notes":[{"CveYear":"2016","CveId":"10717","Ordinal":"1","NoteData":"A vulnerability in the encryption and permission implementation of Malwarebytes Anti-Malware consumer version 2.2.1 and prior (fixed in 3.0.4) allows an attacker to take control of the whitelisting feature (exclusions.dat under %SYSTEMDRIVE%\\ProgramData) to permit execution of unauthorized applications including malware and malicious websites. Files blacklisted by Malwarebytes Malware Protect can be executed, and domains blacklisted by Malwarebytes Web Protect can be reached through HTTP.","Type":"Description","Title":null},{"CveYear":"2016","CveId":"10717","Ordinal":"2","NoteData":"2018-03-21","Type":"Other","Title":"Published"},{"CveYear":"2016","CveId":"10717","Ordinal":"3","NoteData":"2018-03-21","Type":"Other","Title":"Modified"}]}}}