Description Preview
This vulnerability, known as "Scripting Engine Memory Corruption Vulnerability," affects Microsoft's Internet Explorer versions 9, 10, and 11. It is a remote code execution vulnerability that exists in the way the scripting engine handles objects in memory. The vulnerability could corrupt memory in a way that allows an attacker to execute arbitrary code in the context of the current user. If the current user is logged on with administrative user rights, an attacker could take control of an affected system. An attacker could then install programs; view, change, or delete data; or create new accounts with full user rights.
Overview
The vulnerability is caused by the way the scripting engine handles objects in memory in Internet Explorer. The issue was first published on 20th December 2018 and it affects various versions of Windows operating systems. The vulnerability has a CVSS base score of 7.5, indicating it has a high severity.
Remediation
Users are advised to apply the necessary updates provided by Microsoft for the affected products. It is also recommended to run all software as a non-privileged user (one without administrative privileges) to diminish the effects of a successful attack. Users should also only open email attachments from trusted sources.
References
Early Warning
Armis Early Warning customers received an advanced alert on this vulnerability.
- Armis Alert Date
- Dec 19, 2018
- CISA KEV Date
- Nov 3, 2021
1050days early
Industry ExposureMost to leastThis section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
This section illustrates the prevalence of a specific Common Vulnerabilities and Exposures (CVE) across various industries based on customer reports. The ranking displays industries from the most to least affected by this particular vulnerability, offering valuable insight into where this CVE has been most frequently observed. This information can help organizations within these sectors prioritize their security efforts, understand their relative risk exposure compared to their peers, and focus remediation strategies where they are most needed. By understanding the industry-specific impact, organizations can make more informed decisions regarding patching, resource allocation, and overall risk management related to this CVE.
- ManufacturingManufacturing
- Health Care & Social AssistanceHealth Care & Social Assistance
- Public AdministrationPublic Administration
- Transportation & WarehousingTransportation & Warehousing
- Educational ServicesEducational Services
- Retail TradeRetail Trade
- Finance and InsuranceFinance and Insurance
- Professional, Scientific, & Technical ServicesProfessional, Scientific, & Technical Services
- Arts, Entertainment & RecreationArts, Entertainment & Recreation
- Management of Companies & EnterprisesManagement of Companies & Enterprises
- Other Services (except Public Administration)Other Services (except Public Administration)
- UtilitiesUtilities
- InformationInformation
- Accommodation & Food ServicesAccommodation & Food Services
- ConstructionConstruction
- Agriculture, Forestry Fishing & HuntingAgriculture, Forestry Fishing & Hunting
- MiningMining
- Real Estate Rental & LeasingReal Estate Rental & Leasing
- Wholesale TradeWholesale Trade
- Administrative, Support, Waste Management & Remediation ServicesAdministrative, Support, Waste Management & Remediation Services
