Remote Code Execution Vulnerability in Microsoft Silverlight
CVE-2013-0074

7.8HIGH

Key Information:

Vendor

Microsoft
Status
Silverlight
Vendor
CVE Published:
13 March 2013

Badges

💰 Ransomware👾 Exploit Exists🟣 EPSS 93%🦅 CISA Reported

What is CVE-2013-0074?

The vulnerability in Microsoft Silverlight 5 and its Developer Runtime, occurring prior to version 5.1.20125.0, stems from improper pointer validation during the rendering of HTML objects. This flaw can be exploited by remote attackers to execute arbitrary code via specially crafted Silverlight applications, posing significant security risks if not addressed.

CISA has reported CVE-2013-0074

CISA provides regional cyber and physical services to support security and resilience across the United States. CISA monitor the most dangerious vulnerabilities and have identifed CVE-2013-0074 as being exploited and is known by the CISA as enabling ransomware campaigns.

The CISA's recommendation is: The impacted product is end-of-life and should be disconnected if still in use.

References

https://oval.cisecurity.org/repository/search/definition/...
vdb-entrysignaturex_refsource_OVAL
https://oval.cisecurity.org/repository/search/definition/...
vdb-entrysignaturex_refsource_OVAL
http://www.us-cert.gov/ncas/alerts/TA13-071A
third-party-advisoryx_refsource_CERT

EPSS Score

93% chance of being exploited in the next 30 days.

CVSS V3.1

Score:
7.8
Severity:
HIGH
Confidentiality:
High
Integrity:
High
Availability:
High
Attack Vector:
Local
Attack Complexity:
Low
Privileges Required:
None
User Interaction:
Required
Scope:
Unchanged

Timeline

  • 💰

    Used in Ransomware

  • 👾

    Exploit known to exist

  • 🦅

    CISA Reported

  • Vulnerability published

  • Vulnerability Reserved

.