CVE-2013-7331
microsoft internet explorer
Published 26 Feb 2014 · updated 17 Jun 2026 · Analyzed
6.5 Medium · CVSS 3.1, CISA ADP
Exploited in the wild
CISA added this to its Known Exploited Vulnerabilities catalog on 25 May 2022, with a remediation deadline of 15 Jun 2022 for US federal agencies.
Required action: Apply updates per vendor instructions.
Description
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
References
- www.fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html · Third Party Advisory
- www.kb.cert.org/vuls/id/539289 · Third Party Advisory, US Government Resource
- www.securitytracker.com/id/1030818 · Third Party Advisory, VDB Entry
- docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052 · Patch, Vendor Advisory
- soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/ · Exploit
- www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331 · US Government Resource