Microsoft · Internet Explorer
End of lifeInternet Explorer reached End of lifeThe vendor no longer ships security fixes. Remove or isolate the product instead of waiting for a patch. on 15 Jun 2022. No patch is coming: remove or isolate it.
The flaw lies in the Microsoft.XMLDOM ActiveX control in Microsoft Internet Explorer, affecting Microsoft Windows 8.1 and earlier. An attacker who can get a victim to load a crafted page over the network can learn local pathnames, UNC share pathnames, and intranet hostnames and IP addresses by reading the error codes the control returns, with no authentication or user interaction required beyond the page load.
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
First seen exploited the day it was disclosed. Public exploit code (Metasploit) appeared 6 months after disclosure.
CISA KEV listing is when exploitation was confirmed, not necessarily the first attack.
Reveals host and network environment information
determine the existence of local pathnames, UNC share pathnames, intranet hostnames
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
Reports are matched by finding the exact id CVE-2013-7331 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
…a spear phishing email message.1 The document, when opened, used an embedded ActiveX control to download a JavaScript file from a remote site that used a previously unknown vulnerability in some versions of Windows (later designated CVE-2013-7331) to read information about the browser’s installed…
3 passages name itOriginal (opens in a new tab) ↗
…exploits targeting CVE-2013-2551, a use-after-free vulnerability in versions 6 through 10 of Internet Explorer, accounted for the largest share of browser-related exploit encounters in 2H14, then fell to negligible levels in 1H15 as exploit kit authors dropped them in favor of exploits targeting CVE-2013-7331.
2 passages name itOriginal (opens in a new tab) ↗
Pulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.