Microsoft Internet Explorer 9/10/11 Cross-Domain Security information disclosure
| CVSS Meta Temp Score | Current Exploit Price (≈) | CTI Interest Score |
|---|---|---|
| 3.8 | $0-$5k | 0.00 |
A vulnerability classified as problematic was found in Microsoft Internet Explorer 9/10/11 (Web Browser). Affected by this vulnerability is an unknown code block of the component Cross-Domain Security Handler. The manipulation with an unknown input leads to a information disclosure vulnerability. The CWE definition for the vulnerability is CWE-200. The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information. As an impact it is known to affect confidentiality. The summary by CVE is:
Microsoft Internet Explorer 9 through 11 allows remote attackers to read content from a different (1) domain or (2) zone via a crafted web site, aka "Internet Explorer Cross-domain Information Disclosure Vulnerability."
The issue has been introduced in 03/16/2010. The weakness was released 02/11/2014 by Dieyu as MS14-010 as confirmed bulletin (Technet). The advisory is shared at technet.microsoft.com. This vulnerability is known as CVE-2014-0293 since 12/03/2013. The attack can be launched remotely. The exploitation doesn't need any form of authentication. It demands that the victim is doing some kind of user interaction. Neither technical details nor an exploit are publicly available. MITRE ATT&CK project uses the attack technique T1592 for this issue.
The vulnerability was handled as a non-public zero-day exploit for at least 1428 days. During that time the estimated underground price was around $25k-$100k. The vulnerability scanner Nessus provides a plugin with the ID 72433 (MS14-010: Cumulative Security Update for Internet Explorer (2909921)), which helps to determine the existence of the flaw in a target environment. It is assigned to the family Windows : Microsoft Bulletins. The commercial vulnerability scanner Qualys is able to test this issue with plugin 100178 (Microsoft Internet Explorer Multiple Remote Code Execution Vulnerabilities (MS14-010)).
Applying the patch MS14-010 is able to eliminate this problem. The bugfix is ready for download at technet.microsoft.com. A possible mitigation has been published immediately after the disclosure of the vulnerability.
The vulnerability is also documented in the databases at X-Force (90758), Tenable (72433), SecurityFocus (BID 65394†), OSVDB (103167†) and Secunia (SA56796†). Additional details are provided at zdnet.com. Entries connected to this vulnerability are available at VDB-12238, VDB-12239, VDB-12240 and VDB-12242. Several companies clearly confirm that VulDB is the primary source for best vulnerability data.
Product
Type
Vendor
Name
Version
License
Support
CPE 2.3
CPE 2.2
CVSSv4
VulDB Vector: 🔍VulDB Reliability: 🔍
CVSSv3
VulDB Meta Base Score: 4.3VulDB Meta Temp Score: 3.8
VulDB Base Score: 4.3
VulDB Temp Score: 3.8
VulDB Vector: 🔍
VulDB Reliability: 🔍
CVSSv2
| AV | AC | Au | C | I | A |
|---|---|---|---|---|---|
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| 💳 | 💳 | 💳 | 💳 | 💳 | 💳 |
| Vector | Complexity | Authentication | Confidentiality | Integrity | Availability |
|---|---|---|---|---|---|
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
| unlock | unlock | unlock | unlock | unlock | unlock |
VulDB Base Score: 🔍
VulDB Temp Score: 🔍
VulDB Reliability: 🔍
NVD Base Score: 🔍
Exploiting
Class: Information disclosureCWE: CWE-200 / CWE-284 / CWE-266
CAPEC: 🔍
ATT&CK: 🔍
Local: No
Remote: Yes
Availability: 🔍
Status: Unproven
EPSS Score: 🔍
EPSS Percentile: 🔍
Price Prediction: 🔍
Current Price Estimation: 🔍
| 0-Day | unlock | unlock | unlock | unlock |
|---|---|---|---|---|
| Today | unlock | unlock | unlock | unlock |
Nessus ID: 72433
Nessus Name: MS14-010: Cumulative Security Update for Internet Explorer (2909921)
Nessus File: 🔍
Nessus Risk: 🔍
Nessus Family: 🔍
Qualys ID: 🔍
Qualys Name: 🔍
Threat Intelligence
Interest: 🔍Active Actors: 🔍
Active APT Groups: 🔍
Countermeasures
Recommended: PatchStatus: 🔍
Reaction Time: 🔍
0-Day Time: 🔍
Exposure Time: 🔍
Patch: MS14-010
Timeline
03/16/2010 🔍12/03/2013 🔍
02/11/2014 🔍
02/11/2014 🔍
02/11/2014 🔍
02/11/2014 🔍
02/11/2014 🔍
02/12/2014 🔍
02/12/2014 🔍
01/09/2025 🔍
Sources
Vendor: microsoft.comAdvisory: MS14-010
Researcher: Dieyu
Status: Confirmed
CVE: CVE-2014-0293 (🔍)
GCVE (CVE): GCVE-0-2014-0293
GCVE (VulDB): GCVE-100-12241
OVAL: 🔍
IAVM: 🔍
X-Force: 90758 - Microsoft Internet Explorer cross-domain policies information disclosure, Medium Risk
SecurityFocus: 65394 - Microsoft Internet Explorer CVE-2014-0293 Cross Domain Information Disclosure Vulnerability
Secunia: 56796 - Microsoft Internet Explorer Multiple Vulnerabilities, Highly Critical
OSVDB: 103167
SecurityTracker: 1029741
Vulnerability Center: 43212 - [MS14-010] Microsoft Internet Explorer 9 Through 11 Remote Information Disclosure (CVE-2014-0293), Medium
Misc.: 🔍
See also: 🔍
Entry
Created: 02/12/2014 02:32 PMUpdated: 01/09/2025 09:24 PM
Changes: 02/12/2014 02:32 PM (78), 04/07/2017 12:04 PM (6), 06/09/2021 09:21 AM (2), 06/09/2021 09:22 AM (1), 12/22/2024 05:48 AM (16), 01/09/2025 09:24 PM (1)
Complete: 🔍
Cache ID: 18:3F6:40
No comments yet. Languages: en.
Please log in to comment.