CVE-2013-7331KEV · OVERDUE

Microsoft Internet Explorer Information Disclosure Vulnerability

Medium · published February 26, 2014

Patch now

The score understates this — it's already being exploited

CVSS calls it medium at 6.5. It is confirmed in active exploitation. It sits in the 98.9th percentile for exploit probability.

1590
days past CISA
deadline
CVSS v3.1
6.5
EPSS
50%
Percentile
98.9
In the wild
Confirmed
What it is

⚠️ This sneaky little bug can leak your local pathnames just by looking for error codes! It's like a nosy neighbor peeking through your window to see what you've got inside. 🕵️‍♂️ Imagine a delivery driver who can figure out your house number just by looking at the way you answer the door. That’s what this vulnerability does for attackers; it reveals your local paths and IP addresses based on simple error messages. An attacker could exploit this vulnerability to discover sensitive information about your internal network, potentially leading to more serious threats. They could map out your intranet, providing them with a roadmap for future attacks. This could compromise not just one machine, but the entire network's security framework!

Put simply

Imagine a delivery driver who can figure out your house number just by looking at the way you answer the door. That’s what this vulnerability does for attackers; it reveals your local paths and IP addresses based on simple error messages. CVE-2013-7331 allows remote attackers to examine error codes returned by the Microsoft.XMLDOM ActiveX control, revealing local pathnames and intranet hostnames or IP addresses. This occurs in Windows 8.1 and earlier, exploited through a specially crafted res:// URL.

What to do

An attacker could exploit this vulnerability to discover sensitive information about your internal network, potentially leading to more serious threats. They could map out your intranet, providing them with a roadmap for future attacks. This could compromise not just one machine, but the entire network's security framework! To protect yourself, disable the ActiveX controls in Internet Explorer or restrict its use in your environment. Additionally, consider updating your systems if you haven’t already; newer versions of Windows address these concerns. Regularly audit your network for unusual activities to spot potential exploitation attempts. You've got this! With these steps, you’ll bolster your defenses and keep those nosy neighbors at bay. 🛡️

The record
Technical detail
CVSS v3.1
6.5 · MEDIUM
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
CVSS v4.0
Not supplied
EPSS
0.50210 · 98.9th percentile
Published
2014-02-26T11:00Z
KEV added
2022-05-25 · due 2022-06-15
EPSS history
Timeline
  • 25 MAY 00:00Z
    Added to CISA KEV — remediate by Jun 15
    kev
  • 26 FEB 11:00Z
    The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share…
    cvelistv5