medium5.5Known exploitedPublic exploit code
CVE-2013-3896
Microsoft Silverlight Information Disclosure Vulnerability
Exploited in the wild
This vulnerability is on a Known Exploited Vulnerabilities catalogue, added 2022-05-25. Federal due date: 2022-06-15.
The impacted product is end-of-life and should be disconnected if still in use.
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Silverlight - ScriptObject Unsafe Memory Access (MS13-022/MS13-087) (Metasploit)2013-03-12 · local · windows · Verified
Impact
Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Silverlight | from 5.0 before 5.1.20913.0 |
References
- NVD record
- CVE.org record
- CISA KEV catalog
- http://www.us-cert.gov/ncas/alerts/TA13-288A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19055
- http://www.us-cert.gov/ncas/alerts/TA13-288A
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2013/ms13-087
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19003
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A19055
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3896