CVE-2018-8353

EPSS 67.7%

Vexday Risk Score

35Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Popular PoC on GitHub (2 stars) — exploitation code widely available.

CVSS —EPSS 67.7%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

15 Aug 2018Published on NVD

28 Aug 2018Public PoC

Weaponization speed

12 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

A remote code execution vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Memory Corruption Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-8355, CVE-2018-8359, CVE-2018-8371, CVE-2018-8372, CVE-2018-8373, CVE-2018-8385, CVE-2018-8389, CVE-2018-8390.

Affected products

n/a · n/a

public PoCs found — 3

githubgithub.com/whereisr0da/CVE-2018-8353-POC★ 2 cve_referencewww.exploit-db.com/exploits/45279/unverified exploitdbwww.exploit-db.com/exploits/45279unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8353 https://www.exploit-db.com/exploits/45279/http://www.securityfocus.com/bid/105034 http://www.securitytracker.com/id/1041483