CVE-2018-8373

HIGHCISA KEV

7.5

Beschreibung

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8353, CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.

CVE Details

CVSS v3.1 Bewertung7.5

SchweregradHIGH

CVSS VektorCVSS:3.1/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H

AngriffsvektorNETWORK

KomplexitatHIGH

Erforderliche PrivilegienNONE

BenutzerinteraktionREQUIRED

Veroffentlicht8/15/2018

Zuletzt geandert10/28/2025

Quellekev

Honeypot-Sichtungen0

CISA KEV

HerstellerMicrosoft

ProduktInternet Explorer Scripting Engine

SchwachstellennameMicrosoft Scripting Engine Memory Corruption Vulnerability

KEV Aufnahmedatum2022-03-25

Behebungsfrist2022-04-15

Ransomware-NutzungUnknown

Betroffene Produkte

microsoft:internet_explorermicrosoft:windows_10_1507microsoft:windows_10_1607microsoft:windows_10_1703microsoft:windows_10_1709microsoft:windows_10_1803microsoft:windows_7microsoft:windows_8.1microsoft:windows_rt_8.1microsoft:windows_server_2008microsoft:windows_server_2012microsoft:windows_server_2016

Schwachen (CWE)

CWE-787CWE-787

Referenzen

http://www.securityfocus.com/bid/105037(secure@microsoft.com)

http://www.securitytracker.com/id/1041483(secure@microsoft.com)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8373(secure@microsoft.com)

http://www.securityfocus.com/bid/105037(af854a3a-2127-422b-91ae-364da2661108)

http://www.securitytracker.com/id/1041483(af854a3a-2127-422b-91ae-364da2661108)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8373(af854a3a-2127-422b-91ae-364da2661108)

https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2018-8373(134c704f-9b21-4f2e-91b3-4a467353bcc0)

IOC Korrelationen

Keine Korrelationen erfasst

This product uses data from the NVD API but is not endorsed or certified by the NVD.