CVE-2013-7331mediumunder attackCWE-209

CVE-2013-7331

Published · Updated

Follow this CVE+ Monitor Internet Explorer

E-mail alert when it lands in KEV, gets a public PoC or its score goes up.

70Vexday Risk Score

Patch now. It under exploitation confirmed by CISA and has a working public exploit.

ssvc Actcvss 6.5epss 50%
from disclosure to weapon195 days
Published on NVDFeb 26
metasploit+195d
CISA KEV+3010d
Action required by CISAfederal deadline: 2022-06-15

Apply updates per vendor instructions.

In short

A flaw in Microsoft's XMLDOM ActiveX control lets remote attackers discover whether specific files, network shares, or internal server names exist on a computer by observing error messages. This information leak could help attackers map a target's internal network.

Technical detail

CWE-209 (Information Exposure Through an Error Message) in XMLDOM ActiveX control allows unauthenticated remote attackers to perform reconnaissance via res:// protocol URLs; error responses disclose existence of local paths, UNC shares, and intranet hostnames without requiring user interaction, facilitating network enumeration attacks.

Summary generated and translated by AI from the official description.

The full analysis of this CVE is available in Portuguese →

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Affected products
n/a · n/a