{"id":"CVE-2013-7331","published":"2014-02-26T14:55:08Z","modified":"2026-06-17T00:01:46Z","title":"Microsoft Internet Explorer Information Disclosure Vulnerability","vendor":"Microsoft","product":"Internet Explorer","tier":"core","eol":{"product":"Internet Explorer","since":"2022-06-15","note":"No security updates; remove it."},"description":{"text":"The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.","provenance":"source","from":"NVD"},"summary":{"text":"The flaw lies in the Microsoft.XMLDOM ActiveX control in Microsoft Internet Explorer, affecting Microsoft Windows 8.1 and earlier. An attacker who can get a victim to load a crafted page over the network can learn local pathnames, UNC share pathnames, and intranet hostnames and IP addresses by reading the error codes the control returns, with no authentication or user interaction required beyond the page load.","provenance":"ai","model":"claude-haiku-5-5","generatedAt":"2026-10-23T07:05:21Z"},"cvss":{"score":6.5,"severity":"MEDIUM","version":"3.1","vector":"CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L","provenance":"source","from":"NVD"},"epss":{"score":0.5021,"percentile":0.98902,"date":"2026-10-28","provenance":"source"},"kev":{"dateAdded":"2022-05-25","dueDate":"2022-06-15","ransomware":false,"requiredAction":"Apply updates per vendor instructions.","notes":"https://nvd.nist.gov/vuln/detail/CVE-2013-7331","provenance":"source"},"vulncheckKev":{"dateAdded":"2014-02-26","exploitedFirstSeen":"2014-02-26","ransomware":true,"evidence":[{"url":"https://www.cve.org/CVERecord?id=CVE-2013-7331","date":"2014-02-26"},{"url":"http://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf","date":"2016-04-01"},{"url":"https://cybersecurityworks.com/pdf/ransomware/Spotlight_Ransomware2021.pdf","date":"2021-02-11"},{"url":"https://dl.acm.org/doi/pdf/10.1145/3465481.3465758","date":"2021-08-17"},{"url":"https://www.cisa.gov/sites/default/files/feeds/known_exploited_vulnerabilities.json","date":"2022-05-25"}],"evidenceTotal":5,"provenance":"source"},"exploited":true,"otx":{"pulseCount":50,"pulses":[{"name":"Actively_Exploited_Kev | Oct 29, 2026","url":"https://otx.alienvault.com/pulse/6ae20c1db17e7057ae7d9ad1","created":"2026-10-28"},{"name":"Actively_Exploited_Kev | Oct 28, 2026","url":"https://otx.alienvault.com/pulse/6ae0ba7e0e2a97ff7b218819","created":"2026-10-27"},{"name":"Actively_Exploited_Kev | Oct 27, 2026","url":"https://otx.alienvault.com/pulse/6adf68b85c3e852f3c111d18","created":"2026-10-26"},{"name":"Actively_Exploited_Kev | Oct 24, 2026","url":"https://otx.alienvault.com/pulse/6adb740e397c3ad4799aa4cd","created":"2026-10-23"},{"name":"Actively_Exploited_Kev | Oct 23, 2026","url":"https://otx.alienvault.com/pulse/6ada236fcfba2dfa730ea482","created":"2026-10-22"},{"name":"Actively_Exploited_Kev | Oct 22, 2026","url":"https://otx.alienvault.com/pulse/6ad8d33a077cbb5cab524d80","created":"2026-10-21"},{"name":"Actively_Exploited_Kev | Oct 21, 2026","url":"https://otx.alienvault.com/pulse/6ad78130c4d1ac2be83a8b6d","created":"2026-10-20"},{"name":"Actively_Exploited_Kev | Oct 20, 2026","url":"https://otx.alienvault.com/pulse/6ad62f63c24a405a3423cc13","created":"2026-10-19"},{"name":"Actively_Exploited_Kev | Oct 19, 2026","url":"https://otx.alienvault.com/pulse/6ad4dda174e5797d0bd238b7","created":"2026-10-18"},{"name":"Actively_Exploited_Kev | Oct 18, 2026","url":"https://otx.alienvault.com/pulse/6ad38c22e1848f8189d1c121","created":"2026-10-17"}],"provenance":"machine"},"cwes":[{"id":"CWE-209","name":"Generation of Error Message Containing Sensitive Information"},{"id":"CWE-200","name":"Exposure of Sensitive Information to an Unauthorized Actor"}],"references":[{"url":"http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html","tags":["Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/539289","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securitytracker.com/id/1030818","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052","tags":["Patch","Vendor Advisory"]},{"url":"https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/","tags":["Exploit"]},{"url":"http://www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html","tags":["Third Party Advisory"]},{"url":"http://www.kb.cert.org/vuls/id/539289","tags":["Third Party Advisory","US Government Resource"]},{"url":"http://www.securitytracker.com/id/1030818","tags":["Third Party Advisory","VDB Entry"]},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052","tags":["Patch","Vendor Advisory"]},{"url":"https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/","tags":["Exploit"]},{"url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331","tags":["US Government Resource"]}],"techniques":[{"id":"T1189","name":"Drive-by Compromise","tactics":["initial-access"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Drive-by via browser ActiveX control; remote web delivery","mappingType":"exploitation_technique","evidence":[{"from":"description","quote":"allows remote attackers to determine the existence of local pathnames","start":74,"end":143}],"model":"claude-haiku-5-5","confidence":"low","confidenceNote":"server-side bug exploitable without user interaction; client-execution technique does not fit"},{"id":"T1592","name":"Gather Victim Host Information","tactics":["reconnaissance"],"provenance":"ai","basis":"ai-mapping","bases":["ai-mapping"],"basisDetail":"claude-haiku-5-5: Reveals host and network environment information","mappingType":"primary_impact","evidence":[{"from":"description","quote":"determine the existence of local pathnames, UNC share pathnames, intranet hostnames","start":101,"end":184}],"model":"claude-haiku-5-5","confidence":"medium","confidenceNote":"AI-mapped from the description (quote-validated, not expert-reviewed)"}],"reports":[{"id":"SRC-a27ca573b9cba018268a","title":"Platinum feature article   Targeted attacks in South and Southeast Asia April 2016","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/2/2/5/225BFE3E-E1DE-4F5B-A77B-71200928D209/Platinum%20feature%20article%20-%20Targeted%20attacks%20in%20South%20and%20Southeast%20Asia%20April%202016.pdf","date":null,"mentions":[{"quote":"a spear phishing email message.1 The\r\ndocument, when opened, used an embedded ActiveX control to download a JavaScript file from a\r\nremote site that used a previously unknown vulnerability in some versions of Windows (later designated\r\nCVE-2013-7331) to read information about the browser’s installed","start":11483,"end":11783},{"quote":"CVE-2013-7331 has never affected Windows 10.","start":11958,"end":12002},{"quote":"Malicious Word 2003 files used by PLATINUM to deliver CVE-2013-7331","start":12026,"end":12093}]},{"id":"SRC-619721166ae9d9d7fdcd","title":"Microsoft Security","publisher":"download.microsoft.com","url":"https://download.microsoft.com/download/4/4/C/44CDEF0E-7924-4787-A56A-16261691ACE3/Microsoft_Security_Intelligence_Report_Volume_19_English.pdf","date":null,"mentions":[{"quote":" Exploits targeting CVE-2013-7331, a vulnerability affecting the","start":94255,"end":94320},{"quote":"exploits targeting CVE-2013-2551, a use-after-free\r\nvulnerability in versions 6 through 10 of Internet Explorer, accounted for the\r\nlargest share of browser-related exploit encounters in 2H14, then fell to\r\nnegligible levels in 1H15 as exploit kit authors dropped them in favor of\r\nexploits targeting CVE-2013-7331.","start":95059,"end":95374},{"quote":"CVE-2013-7331","start":95508,"end":95521},{"quote":"52\r\nCVE-2010-0840, 47, 49\r\nCVE-2010-2568, 40, 43, 50\r\nCVE-2010-3336, 52\r\nCVE-2011-1823, 50, 51\r\nCVE-2011-3874, 50, 51\r\nCVE-2012-0158, 52\r\nCVE-2012-0507, 47, 49\r\nCVE-2012-1723, 47, 48, 49\r\nCVE-2012-1889, 54\r\nCVE-2013-0074, 46\r\nCVE-2013-0422, 47, 49\r\nCVE-2013-2460, 46\r\nCVE-2013-2551, 46, 54\r\nCVE-2013-7331,","start":237961,"end":238266}]}],"affected":[],"advisories":[],"euvd":{"id":"EUVD-2013-7105","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-7105","exploited":true,"exploitedSince":"2022-05-25","provenance":"source"},"exploits":[],"exploitSources":{"metasploit":[{"name":"MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure","module":"auxiliary/gather/ms14_052_xmldom","type":"auxiliary","disclosureDate":"2014-09-09","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ms14_052_xmldom.rb"}],"first":{"date":"2014-09-09","source":"Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ms14_052_xmldom.rb"},"provenance":"source"},"exploitRefs":["https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/"],"flow":[{"stage":"primary","techniques":["T1592"],"provenance":"ai"},{"stage":"related","techniques":["T1189"],"provenance":"ai","lowConfidence":true}],"timeline":[{"date":"2014-02-26","kind":"published","label":"Published (NVD)","url":"https://nvd.nist.gov/vuln/detail/CVE-2013-7331","provenance":"source"},{"date":"2014-02-26","kind":"exploited-reported","label":"Exploitation first reported (VulnCheck KEV evidence)","url":"https://www.cve.org/CVERecord?id=CVE-2013-7331","provenance":"source"},{"date":"2014-09-09","kind":"exploit-public","label":"First public exploit: Metasploit","url":"https://github.com/rapid7/metasploit-framework/blob/master/modules/auxiliary/gather/ms14_052_xmldom.rb","provenance":"source"},{"date":"2022-05-25","kind":"kev","label":"Added to CISA KEV","url":"https://www.cisa.gov/known-exploited-vulnerabilities-catalog","provenance":"source"},{"date":"2022-05-25","kind":"euvd-exploited","label":"ENISA EUVD: exploited","url":"https://euvd.enisa.europa.eu/vulnerability/EUVD-2013-7105","provenance":"source"}],"speed":{"daysToPublicExploit":195,"firstExploitFrom":"Metasploit","daysToKev":3010},"priority":{"score":68.5,"factors":[{"name":"In a KEV catalog","points":35.0,"detail":"listed in CISA KEV and VulnCheck KEV"},{"name":"Recent KEV listing","points":0.0,"detail":"added 4628 days ago"},{"name":"Known ransomware use","points":10.0,"detail":"CISA KEV and VulnCheck KEV: Known"},{"name":"EPSS percentile","points":19.78,"detail":"percentile 0.9890"},{"name":"Named in threat reports","points":6.13,"detail":"2 reports"},{"name":"Public exploit code","points":5.0,"detail":"1 NVD reference tagged Exploit; 1 Metasploit module"},{"name":"Mentioned in OTX pulses","points":3.0,"detail":"50 pulses"},{"name":"CVSS severity","points":4.55,"detail":"base score 6.5"},{"name":"End-of-life product","points":-15.0,"detail":"No patches exist; remove or isolate it"}]},"lineage":{"familyId":"fam-class-microsoft-internet-explorer-cwe-200"}}