CVE-2013-7331 kev in the critical feed json
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathn…
published 2014-02-26 12 y ago modified 2026-06-17 4 mo ago also EUVD-2013-7105
- cvss
- 6.5
- version 3.1, CNA
- cisa kev
- Exploited
- added 2022-05-25
- epss
- 50.2%
- EPSS 50.2% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Metasploit
Summary
The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.
Patch / fix
cisa required action Apply updates per vendor instructions.
Timeline
- Published
- First public exploit (Metasploit auxiliary/gather/ms14_052_xmldom)
- Added to CISA KEV
- CISA patch deadline
- CISA SSVC: exploitation active
Known exploited
- Added
- 4 y ago
- Patch by
- 2022-06-15 (4 y ago)
- Ransomware
- Not known
- Required action
- Apply updates per vendor instructions.
- Vendor, product
- Microsoft, Internet Explorer
- CISA name
- Microsoft Internet Explorer Information Disclosure Vulnerability
CISA SSVC
- Exploitation
- Active, exploited in the wild
- Automatable
- yes
- Technical impact
- partial
- Assessed
- 20 mo ago
Exploit prediction
50.21% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- Metasploit auxiliary/gather/ms14_052_xmldom MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure metasploit auxiliary, normal rank, 2014-09-09
- soroush.secproject.com https://soroush.secproject.com/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/ referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
| CNA | 3.1 | 6.5 | CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-209 Generation of Error Message Containing Sensitive Information
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2014/ms14-052
vendor-advisory, patch
-
soroush.secproject.com
/blog/2013/04/microsoft-xmldom-in-ie-can-divulge-information-of-local-drivenetwork-in-error-messages/
exploit
-
securitytracker.com
/id/1030818
vdb-entry, third-party-advisory
-
kb.cert.org
/vuls/id/539289
third-party-advisory, us-government-resource
-
fireeye.com
/blog/uncategorized/2014/02/operation-snowman-deputydog-actor-compromises-us-veterans-of-foreign-wars-website.
third-party-advisory
-
cisa.gov
/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-7331
government-resource, us-government-resource
Sources
- CVE List CVE-2013-7331
- NVD CVE-2013-7331
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.