Vulnerability Details : CVE-2010-0483

Public exploit exists!
vbscript.dll in VBScript 5.1, 5.6, 5.7, and 5.8 in Microsoft Windows 2000 SP4, XP SP2 and SP3, and Server 2003 SP2, when Internet Explorer is used, allows user-assisted remote attackers to execute arbitrary code by referencing a (1) local pathname, (2) UNC share pathname, or (3) WebDAV server with a crafted .hlp file in the fourth argument (aka helpfile argument) to the MsgBox function, leading to code execution involving winhlp32.exe when the F1 key is pressed, aka "VBScript Help Keypress Vulnerability."
Published 2010-03-03 19:30:01
Updated 2025-04-11 00:51:22
Source Microsoft Corporation
View at NVD,   CVE.org
Vulnerability category: Execute code

Products affected by CVE-2010-0483

Exploit prediction scoring system (EPSS) score for CVE-2010-0483

EPSS FAQ
81.70%
Probability of exploitation activity in the next 30 days EPSS Score History
~ 99 %
Percentile, the proportion of vulnerabilities that are scored at or less

Metasploit modules for CVE-2010-0483

  • MS10-022 Microsoft Internet Explorer Winhlp32.exe MsgBox Code Execution
    Disclosure Date: 2010-02-26
    First seen: 2020-04-26
    exploit/windows/browser/ms10_022_ie_vbscript_winhlp32
    This module exploits a code execution vulnerability that occurs when a user presses F1 on MessageBox originated from VBscript within a web page. When the user hits F1, the MessageBox help functionality will attempt to load and use a HLP file from an SMB or WebDAV (

CVSS scores for CVE-2010-0483

Base Score Base Severity CVSS Vector Exploitability Score Impact Score Score Source First Seen
7.6
 HIGH AV:N/AC:H/Au:N/C:C/I:C/A:C
4.9
10.0
 NIST

CWE ids for CVE-2010-0483

  • The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.
    Assigned by: nvd@nist.gov (Primary)

References for CVE-2010-0483

Jump to
This web site uses cookies for managing your session, storing preferences, website analytics and additional purposes described in our privacy policy.
By using this web site you are agreeing to CVEdetails.com terms of use!
Accept Close