CVE-2019-0676 : An information disclosure vulnerability exists when Internet Explorer improperly

An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory.An attacker who successfully exploited this vulnerability could test for the presence of files on disk, aka 'Internet Explorer Information Disclosure Vulnerability'.

Published 2019-03-05 23:29:03

Updated 2020-08-24 17:37:01

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2019-0676

Microsoft » Internet Explorer » Version: 10
cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2012 » Version: N/A
Microsoft » Internet Explorer » Version: 11
cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 10 » Version: 1607
When used together with: Microsoft » Windows 10 » Version: 1703
When used together with: Microsoft » Windows 10 » Version: 1709
When used together with: Microsoft » Windows 10 » Version: 1803
When used together with: Microsoft » Windows 10 » Version: 1809
When used together with: Microsoft » Windows 7 » Version: N/A Update SP1
When used together with: Microsoft » Windows 8.1 » Version: N/A
When used together with: Microsoft » Windows Rt 8.1 » Version: N/A
When used together with: Microsoft » Windows Server 2008 » Version: R2 For X64
When used together with: Microsoft » Windows Server 2012 » Version: R2
When used together with: Microsoft » Windows Server 2016 » Version: N/A
When used together with: Microsoft » Windows Server 2019 » Version: N/A

CVE-2019-0676 is in the CISA Known Exploited Vulnerabilities Catalog

CISA vulnerability name:

Microsoft Internet Explorer Information Disclosure Vulnerability

CISA required action:

Apply updates per vendor instructions.

CISA description:

An information disclosure vulnerability exists when Internet Explorer improperly handles objects in memory. An attacker who successfully exploited this vulnerability could test for the presence of files on disk.

Notes:

https://nvd.nist.gov/vuln/detail/CVE-2019-0676

Added on 2022-05-23 Action due date 2022-06-13

Exploit prediction scoring system (EPSS) score for CVE-2019-0676

EPSS FAQ

1.83%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 89 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2019-0676

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:P/I:N/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
6.5	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N	2.8	3.6	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: High Integrity: None Availability: None

References for CVE-2019-0676

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2019-0676

CVE-2019-0676 | Internet Explorer Information Disclosure Vulnerability
Patch;Vendor Advisory
http://www.securityfocus.com/bid/106886

Microsoft Internet Explorer CVE-2019-0676 Information Disclosure Vulnerability
Third Party Advisory;VDB Entry

Jump to

Vulnerability Details : CVE-2019-0676

Products affected by CVE-2019-0676

CVE-2019-0676 is in the CISA Known Exploited Vulnerabilities Catalog

Exploit prediction scoring system (EPSS) score for CVE-2019-0676

CVSS scores for CVE-2019-0676

References for CVE-2019-0676