CVE-2020-1380KEV · OVERDUE

Scripting Engine Memory Corruption Vulnerability

High · published August 17, 2020

Patch now

Confirmed exploited, and the score agrees

CVSS calls it high at 7.8. It is confirmed in active exploitation. It sits in the 97.9th percentile for exploit probability.

1634
days past CISA
deadline
CVSS v3.1
7.8
EPSS
24%
Percentile
97.9
In the wild
Confirmed
What it is

🚨 A sneaky memory corruption flaw in Internet Explorer could allow attackers to execute arbitrary code just by getting you to visit a crafted website! ⚡ Think of your computer as a really fancy restaurant kitchen. If an attacker could slip in a dish made with spoiled ingredients, they could cause a lot of chaos — just like how this vulnerability lets them corrupt memory and execute code without you even knowing it! If exploited, this vulnerability could allow attackers to gain control over your system, acting as the current user. That means they could install programs, access or delete your data, and even create new accounts with full rights! Imagine someone sneaking into the kitchen and starting a fire; it’s that serious!

Put simply

Think of your computer as a really fancy restaurant kitchen. If an attacker could slip in a dish made with spoiled ingredients, they could cause a lot of chaos — just like how this vulnerability lets them corrupt memory and execute code without you even knowing it! This remote code execution vulnerability stems from how the scripting engine in Internet Explorer handles objects in memory. When manipulated, it allows attackers to execute code in the context of the logged-in user, potentially leading to full system compromise.

What to do

If exploited, this vulnerability could allow attackers to gain control over your system, acting as the current user. That means they could install programs, access or delete your data, and even create new accounts with full rights! Imagine someone sneaking into the kitchen and starting a fire; it’s that serious! To protect yourself, update Internet Explorer to the latest version immediately. Ensure you have the latest security patches installed and consider switching to a more secure browser altogether. Don't forget to remind your team about safe browsing practices! You've got this! By following these steps, you'll keep your system secure and stay in control. 🛡️

The record
Technical detail
CVSS v3.1
7.8 · HIGH
Vector
CVSS:3.1/AV:L/AC:L/PR:L/UI:N/S:U/C:H/I:H/A:H/E:P/RL:O/RC:C
CVSS v4.0
Not supplied
EPSS
0.24188 · 97.9th percentile
Published
2020-08-17T19:13Z
KEV added
2021-11-03 · due 2022-05-03
EPSS history
Timeline
  • 03 NOV 00:00Z
    Added to CISA KEV — remediate by May 3
    kev
  • 17 AUG 19:13Z
    Scripting Engine Memory Corruption Vulnerability
    cvelistv5