High
Internet Explorer RCE through scripting engine memory corruption (IE 9, 10, 11)
Add Reference
Description
URL
Type
Internet Explorer RCE through scripting engine memory corruption (IE 9, 10, 11)
MITRE ATT&CK
Collection
Command and Control
Credential Access
Defense Evasion
Discovery
Execution
Exfiltration
Impact
Initial Access
Lateral Movement
Persistence
Privilege Escalation
Description
A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka ‘Scripting Engine Memory Corruption Vulnerability’. This CVE ID is unique from CVE-2019-1426, CVE-2019-1427, CVE-2019-1428.
Add Assessment
Ratings
-
Attacker ValueHigh
Technical Analysis
Since this is being exploited in the wild, and affects a wide range of Internet Explorer versions, it looks like it will have some longterm success in targeted phishing and malvertizing campaigns. IE might be down to just 2% of usage, but it’s the only option out of the box on most WIndows Server versions, so it’s at least easy-ish to be running a vulnerable version until you can get patches applied or download a different browser first.
Probably only urgent to patch if you actually use it.
Technical Analysis
Reported as exploited in the wild as part of Google’s 2020 0day vulnerability spreadsheet they made available at https://docs.google.com/spreadsheets/d/1lkNJ0uQwbeC1ZTRrxdtuPLCIl7mlUreoKfSIgajnSyY/edit#gid=1869060786. Original tweet announcing this spreadsheet with the 2020 findings can be found at https://twitter.com/maddiestone/status/1329837665378725888
CVSS V3 Severity and Metrics
General Information
Vendors
- Microsoft
Products
- Internet Explorer 9,
- Internet Explorer 11,
- Internet Explorer 11 on Windows Server 2012,
- Internet Explorer 11 on Windows 10 Version 1903 for 32-bit Systems,
- Internet Explorer 11 on Windows 10 Version 1903 for x64-based Systems,
- Internet Explorer 11 on Windows 10 Version 1903 for ARM64-based Systems,
- Internet Explorer 10
References
Additional Info
Technical Analysis
Report as Exploited in the Wild
What do we mean by "exploited in the wild"?
By selecting this, you are verifying to the AttackerKB community that either you, or a reputable source (example: a security vendor or researcher), has observed an active attempt by attackers, or IOCs related, to exploit this vulnerability outside of a research environment.
A vulnerability should also be considered "exploited in the wild" if there is a publicly available PoC or exploit (example: in an exploitation framework like Metasploit).
