Vulnerability Details : CVE-2013-1347
Public exploit exists!
Microsoft Internet Explorer 8 does not properly handle objects in memory, which allows remote attackers to execute arbitrary code by accessing an object that (1) was not properly allocated or (2) is deleted, as exploited in the wild in May 2013.
Vulnerability category: Execute code
CVE-2013-1347 is in the CISA Known Exploited Vulnerabilities Catalog
CISA vulnerability name:
Microsoft Internet Explorer Remote Code Execution Vulnerability
CISA required action:
Apply updates per vendor instructions.
CISA description:
This vulnerability may corrupt memory in a way that could allow an attacker to execute arbitrary code in the context of the current user within Internet Explorer.
Notes:
https://nvd.nist.gov/vuln/detail/CVE-2013-1347
Added on
2022-03-03
Action due date
2022-03-24
Exploit prediction scoring system (EPSS) score for CVE-2013-1347
97.40%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 100 %
Percentile, the proportion of vulnerabilities that are scored at or less
Metasploit modules for CVE-2013-1347
-
MS13-038 Microsoft Internet Explorer CGenericElement Object Use-After-Free Vulnerability
Disclosure Date: 2013-05-03First seen: 2020-04-26exploit/windows/browser/ie_cgenericelement_uafThis module exploits a vulnerability found in Microsoft Internet Explorer. A use-after-free condition occurs when a CGenericElement object is freed, but a reference is kept on the Document and used again during rendering, an invalid memory that's controllable is us
CVSS scores for CVE-2013-1347
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
9.3
|
HIGH | AV:N/AC:M/Au:N/C:C/I:C/A:C |
8.6
|
10.0
|
NIST | |
|
8.8
|
HIGH | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
2.8
|
5.9
|
NIST | 2024-07-16 |
CWE ids for CVE-2013-1347
-
The product constructs all or part of a code segment using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the syntax or behavior of the intended code segment.Assigned by: nvd@nist.gov (Primary)
-
The product reuses or references memory after it has been freed. At some point afterward, the memory may be allocated again and saved in another pointer, while the original pointer references a location somewhere within the new allocation. Any operations using the original pointer are no longer valid because the memory "belongs" to the code that operates on the new pointer.Assigned by: nvd@nist.gov (Primary)
References for CVE-2013-1347
-
http://technet.microsoft.com/security/advisory/2847140
Microsoft Security Advisory 2847140 | Microsoft DocsMitigation;Patch;Vendor Advisory
-
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A16727
Repository / Oval RepositoryBroken Link
-
http://www.us-cert.gov/ncas/alerts/TA13-134A
Microsoft Updates for Multiple Vulnerabilities | CISAThird Party Advisory;US Government Resource
-
http://www.exploit-db.com/exploits/25294
Microsoft Internet Explorer - CGenericElement Object Use-After-Free (Metasploit) - Windows remote ExploitExploit;Third Party Advisory;VDB Entry
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-038
Microsoft Security Bulletin MS13-038 - Critical | Microsoft DocsPatch;Vendor Advisory
Products affected by CVE-2013-1347
- cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*