vulnwire
7.5high

CVE-2018-8653KEVin critical feed

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scri…

Published 7 y ago · modified 4 mo ago · JSON

CVSS
7.5
v3.1 · CNA
CISA KEV
Yes
added 2021-11-03
EPSS
29.6%
percentile 98%
Public exploits
0
none known

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8643.

Known exploited (CISA KEV)

Added
5 y ago
Due date
2022-05-03 (4 y ago)
Ransomware use
Unknown
Required action
Apply updates per vendor instructions.
Vendor / product
Microsoft / Internet Explorer
CISA name
Microsoft Internet Explorer Scripting Engine Memory Corruption Vulnerability

CISA SSVC assessment

Exploitation
Active — exploited in the wild
Automatable
no
Technical impact
total
Assessed
20 mo ago

Exploit prediction (EPSS)

29.61% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
CISA ADP3.17.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD3.17.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
CNA3.17.5CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H
NVD2.07.6AV:N/AC:H/Au:N/C:C/I:C/A:C

Affected products

  • Microsoft Internet Explorer 9
  • Microsoft Internet Explorer 11
  • Microsoft Internet Explorer 10

Classification

Weakness

References

  • portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2018-8653 · x_refsource_CONFIRM, x_transferred
  • securityfocus.com /bid/106255 · vdb-entry, x_refsource_BID, x_transferred
  • cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8653 · government-resource

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.