CVEvulnerability
CVE-2013-7331
CISA Known Exploited Vulnerability
Microsoft Internet Explorer Information Disclosure Vulnerability — Microsoft Internet Explorer
An information disclosure vulnerability exists in Internet Explorer which allows resources loaded into memory to be queried. This vulnerability could allow an attacker to detect anti-malware applications.
- Added to KEV
- 2022-05-25
- Remediation due
- 2022-06-15
- Ransomware use
- Unknown
- Required action
- Apply updates per vendor instructions.
- Notes
- https://nvd.nist.gov/vuln/detail/CVE-2013-7331
- Status
- Analyzed
- Published
- 2014-02-26
- Last modified
- 2026-06-17
- Assigner
- [email protected]
- CVSS 3.1 (134c704f-9b21-4f2e-91b3-4a467353bcc0)
- 6.5 MEDIUM — CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
- CVSS 2.0 ([email protected])
- 4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
- Weaknesses
- CWE-209
Description
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
Affected configurations
• microsoft internet explorer 6
• microsoft internet explorer 7
• microsoft internet explorer 8
• microsoft internet explorer 9
• microsoft internet explorer 10
• microsoft internet explorer 11
Related
Weakness · CWE (1)
- CWE-209 Generation of Error Message Containing Sensitive Information weakness
References
- http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html Third Party Advisory
- http://www.kb.cert.org/vuls/id/539289 Third Party Advisory, US Government Resource
- http://www.securitytracker.com/id/1030818 Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052 Patch, Vendor Advisory
- https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/ Exploit
- http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html Third Party Advisory
- http://www.kb.cert.org/vuls/id/539289 Third Party Advisory, US Government Resource
- http://www.securitytracker.com/id/1030818 Third Party Advisory, VDB Entry
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052 Patch, Vendor Advisory
- https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/ Exploit
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331 US Government Resource