Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2019-0948 — XML External Entity (XXE) Injection in Microsoft Windows 10 Version 1507

CWE-611 — XML External Entity (XXE) Injection6 documents6 sources
Severity
4.7MEDIUMNVD
EPSS
42.2%
top 2.54%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
22
Microsoft Windows 10 Version 1507Microsoft Windows 10 Version 1607Microsoft Windows 10 Version 1703+19 more
Timeline
PublishedJun 12
Latest updateMay 24

Description

An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration. To exploit the vulnerability, an attacker could create a file containing specially crafted XML content and convince an authenticated user to import the file. The update addresses the vulnerability …

CVSS vector

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 1.0 | Impact: 3.6

Affected Packages22 packages

▶CVEListV5microsoft/windows_76.1.0 — publication
▶CVEListV5microsoft/windows_8.16.3.0 — publication
▶CVEListV5microsoft/windows_server_20126.2.9200.0 — publication
▶CVEListV5microsoft/windows_server_201610.0.14393.0 — publication
▶CVEListV5microsoft/windows_server_201910.0.17763.0 — publication

Patches

Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

3
GHSA
GHSA-r88q-8vv9-3qmg: An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr↗2022-05-24
▶
CVEList
Windows Event Viewer Information Disclosure Vulnerability↗2019-06-12
▶
VulnCheck
Microsoft Windows Improper Restriction of XML External Entity Reference↗2019
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Event Viewer 1.0 - XML External Entity Injection↗2016-12-05
▶

📋Vendor Advisories

1
Microsoft
Windows Event Viewer Information Disclosure Vulnerability↗2019-06-11
▶
CVE-2019-0948 — XML External Entity (XXE) Injection | cvebase