6.5Orta
KEV
CVE-2013-7331Microsoft Internet Explorer Information Disclosure Vulnerability
Aktif olarak istismar ediliyor — Microsoft Internet Explorer Information Disclosure Vulnerability
CISA bu açığın gerçek saldırılarda kullanıldığını 25.05.2022 tarihinde doğruladı. ABD federal kurumları için düzeltme son tarihi: 15.06.2022.
Gerekli işlem: Apply updates per vendor instructions. https://nvd.nist.gov/vuln/detail/CVE-2013-7331
Açıklama
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
Zayıflık türü (CWE):
CWE-209
Veri: CVE.org, NVD, CISA KEV, FIRST EPSS, Ubuntu. Bilgiler kaynaktaki haliyle, İngilizce yayımlanır.
Etkilenen ürünler ve sürümler
| Üretici | Ürün | Sürümler | |
|---|---|---|---|
| microsoft | internet explorer | 6 |
Kaynaklar ve yamalar
- https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetw… Exploit
- 1030818 vdb-entryThird Party AdvisoryVDB Entry
- MS14-052 vendor-advisoryPatchVendor Advisory
- VU#539289 third-party-advisoryThird Party AdvisoryUS Government Resource
- http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-o… Third Party Advisory
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331 US Government Resource
CPE eşleşmeleri (NVD) (6)
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*