7.5high
CVE-2019-0752KEV · ransomwarein critical feed1 exploit
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scri…
Published 7 y ago · modified 2 mo ago · JSON
CVSS
7.5
v3.1 · CNA
CISA KEV
Yes
added 2022-02-15
EPSS
81.7%
percentile 100%
Public exploits
1
Exploit-DB
Summary
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka 'Scripting Engine Memory Corruption Vulnerability'. This CVE ID is unique from CVE-2019-0739, CVE-2019-0753, CVE-2019-0862.
Known exploited (CISA KEV)
- Added
- 4 y ago
- Due date
- 2022-08-15 (4 y ago)
- Ransomware use
- Known to be used in ransomware campaigns
- Required action
- Apply updates per vendor instructions.
- Vendor / product
- Microsoft / Internet Explorer
- CISA name
- Microsoft Internet Explorer Type Confusion Vulnerability
CISA SSVC assessment
- Exploitation
- Active — exploited in the wild
- Automatable
- no
- Technical impact
- total
- Assessed
- 4 y ago
Exploit prediction (EPSS)
81.68% probability of exploitation in the next 30 days, higher than 100% of all scored CVEs.
Exploits and detections
- EDB-46928 Microsoft Internet Explorer Windows 10 1809 17763.316 - Scripting Engine Memory Corruption · remote · 2019-05-24
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| CISA ADP | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| CNA | 3.1 | 7.5 | CVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 7.6 | AV:N/AC:H/Au:N/C:C/I:C/A:C |
Affected products
- Microsoft Internet Explorer 11
- Microsoft Internet Explorer 10
Classification
- Weakness
- CWE-843 Access of Resource Using Incompatible Type
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2019-0752 · x_refsource_MISC, x_transferred
- zerodayinitiative.com /advisories/ZDI-19-359/ · x_refsource_MISC, x_transferred
- packetstormsecurity.com /files/153078/Microsoft-Internet-Explorer-Windows-10-1809-17763.316-Memory-Corruption.html · x_refsource_MISC, x_transferred
- cisa.gov /known-exploited-vulnerabilities-catalog?field_cve=CVE-2019-0752 · government-resource
Sources
- CVE List: CVE-2019-0752
- NVD: CVE-2019-0752
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.