Microsoft Internet Explorer Information Disclosure Vulnerability

MEDIUM 6.5EXPLOITED (CISA KEV)CVE-2013-7331 · Published 26/02/2014 · updated 17/06/2026

Microsoft Internet Explorer Information Disclosure Vulnerability. Actively exploited: CISA added this vulnerability to its Known Exploited Vulnerabilities catalog on 25/05/2022. Patch affected systems as an emergency.

Package	Affected versions	Patched versions
internet explorer microsoft	`= 10= 11= 6= 7= 8= 9`	No fix yet

Description

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.

References

fireeye.com/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.html · Third Party Advisory
kb.cert.org/vuls/id/539289 · Third Party Advisory
securitytracker.com/id/1030818 · Third Party Advisory
docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-052 · Patch
soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages · Exploit
cisa.gov/known-exploited-vulnerabilities-catalog · US Government Resource
CISA KEV · CVE-2013-7331

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free