CVE-2013-7331 | BDVDB-2026-60061 Detail
MicrosoftInternet Explorer
Description#
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
Impact#
Per CVSS v3.1: confidentiality impact low, integrity impact none, availability impact low. Attack vector: network.
Weaknesses#
- CWE-209 Generation of Error Message Containing Sensitive Information
References#
- https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/
- http://www.securitytracker.com/id/1030818
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052
- http://www.kb.cert.org/vuls/id/539289
- http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331
Exploit#
No public exploit known
History#
- Version 1Record published in the CVE List.
- Version 2Most recent update recorded in the CVE List.