Vulnerability Details : CVE-2013-1347
Public exploit exists!
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
Vulnerability category: Execute code
CVE-2013-1347 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Microsoft Internet Explorer Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2013-1347
Probability of exploitation activity in the next 30 days: 97.30%
Percentile, the proportion of vulnerabilities that are scored at or less: ~ 100 % EPSS Score History EPSS FAQ
Metasploit modules for CVE-2013-1347
-
MS13-038 Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability
Disclosure Date: 2013-05-03First seen: 2020-04-26exploit/windows/browser/ie_cgenericelement_uafThis module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CGenericElement object is freed, but a reference is kept on the Document and used again during rendering, an invalid memory that's controllable is us
CVSS scores for CVE-2013-1347
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source |
|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST |
CWE ids for CVE-2013-1347
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-1347
-
http://technet.microsoft.com/security/advisory/2847140
Microsoft Security Advisory 2847140 | Microsoft DocsMitigation;Patch;Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16727
Repository / Oval Repository
-
http://www.us-cert.gov/ncas/alerts/TA13-134A
Microsoft Updates for Multiple Vulnerabilities | CISAThird Party Advisory;US Government Resource
-
http://www.exploit-db.com/exploits/25294
Microsoft Internet Explorer - CGenericElement Object Use-After-Free (Metasploit) - Windows remote ExploitExploit;VDB Entry
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-038
Microsoft Security Bulletin MS13-038 - Critical | Microsoft Docs
Products affected by CVE-2013-1347
- cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*