⚠ Actively exploited
Added to CISA KEV on 2021-11-03. Federal agencies required to patch by 2022-05-03. Required action: Apply updates per vendor instructions..

CVE-2019-0541

CWE-77Command Injection7 documents7 sources
Severity
8.8HIGH
EPSS
83.4%
top 0.72%
CISA KEV
KEV
Added 2021-11-03
Due 2022-05-03
Exploit
Exploited in wild
Active exploitation observed
Timeline
PublishedJan 8
KEV addedNov 3
KEV dueMay 3
Latest updateMay 13
CISA Required Action: Apply updates per vendor instructions.

Description

A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vulnerability." This affects Microsoft Office, Microsoft Office Word Viewer, Internet Explorer 9, Internet Explorer 11, Microsoft Excel Viewer, Internet Explorer 10, Office 365 ProPlus.

CVSS vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages10 packages

CVEListV5microsoft/internet_explorer_9Windows Server 2008 for 32-bit Systems Service Pack 2, Windows Server 2008 for x64-based Systems Service Pack 2+1
CVEListV5microsoft/internet_explorer_10Windows Server 2012
CVEListV5microsoft/internet_explorer_1124 versions+23
CVEListV5microsoft/microsoft_office_word_viewerMicrosoft Office Word Viewer

Patches

🔴Vulnerability Details

3
GHSA
GHSA-f832-7fhg-m78h: A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vu2022-05-13
CVEList
CVE-2019-0541: A remote code execution vulnerability exists in the way that the MSHTML engine inproperly validates input, aka "MSHTML Engine Remote Code Execution Vu2019-01-08
VulnCheck
Microsoft MSHTML Remote Code Execution Vulnerability2019

💥Exploits & PoCs

1
Exploit-DB
Microsoft Windows MSHTML Engine - 'Edit' Remote Code Execution2019-03-13

📋Vendor Advisories

2
CISA
Microsoft MSHTML Remote Code Execution Vulnerability2021-11-03
Microsoft
MSHTML Engine Remote Code Execution Vulnerability2019-01-08
CVE-2019-0541 (HIGH CVSS 8.8) | A remote code execution vulnerabili | cvebase.io