CVE-2019-0948
published 2019-06-12CVE-2019-0948: An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an…
PriorityP276medium4.7CVSS 3.1
AVLACHPRNUIRSUCHINAN
ITWEXPLOITVulnCheck KEV
Exploited in the wild
EPSS
12.67%
95.8th percentile
An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.
To exploit the vulnerability, an attacker could create a file containing specially crafted XML content and convince an authenticated user to import the file.
The update addresses the vulnerability by modifying the way that the Event Viewer parses XML input.
Affected
48 ranges· showing 25
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10 | — | — |
| microsoft | windows_10_version_1507 | >= 10.0.10240.0 < publication | publication |
| microsoft | windows_10_version_1607 | >= 10.0.14393.0 < publication | publication |
| microsoft | windows_10_version_1703 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1709 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1709_for_32-bit_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1803 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1809 | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1809 | >= 10.0.17763.0 < publication | publication |
| microsoft | windows_10_version_1903_for_32-bit_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_arm64-based_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_10_version_1903_for_x64-based_systems | >= 10.0.0 < publication | publication |
| microsoft | windows_7 | >= 6.1.0 < publication | publication |
| microsoft | windows_7_service_pack_1 | >= 6.1.0 < publication | publication |
| microsoft | windows_8.1 | >= 6.3.0 < publication | publication |
| microsoft | windows_server_2008 | — | — |
| microsoft | windows_server_2008_r2_service_pack_1 | >= 6.1.7601.0 < publication | publication |
| microsoft | windows_server_2008_r2_systems_service_pack_1 | >= 6.1.0 < publication | publication |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.0 < publication | publication |
| microsoft | windows_server_2008_service_pack_2 | >= 6.0.6003.0 < publication | publication |
Detection & IOCsextracted from sources · hover to see the quote
- →Monitor Windows Event Viewer (eventvwr.msc) for 'Import Custom View' actions where the imported XML file contains DOCTYPE declarations or external entity references (XXE payload pattern). ↗
- →Detect outbound HTTP GET requests originating from eventvwr.msc or mmc.exe to external servers, especially carrying file content as a query parameter — indicative of XXE-based file exfiltration. ↗
- →Alert on .msc files delivered via email, USB, or remote share that contain URLs in the StringsTables section pointing to external servers, as this is the XSS/SMB-relay attack vector. ↗
- →Detect SMB connection attempts originating from mmc.exe or eventvwr.msc to external/untrusted hosts, which may indicate NTLM hash capture via malicious .msc Link to Web Address snap-in. ↗
- →Flag XML files imported into Event Viewer that contain external DTD references (e.g., payload.dtd hosted on a remote server), as this is the two-stage XXE exfiltration technique used in the PoC. ↗
- →Watch for the error message 'The specified custom view is not valid' in Event Viewer combined with outbound network connections, as the exploit succeeds silently from the attacker's perspective while the victim sees this error. ↗
- ·The XXE vulnerability is due to a misconfigured XML parser in the MMC custom view functionality — the parser processes external entities by default. The fix modifies XML parsing behavior in Event Viewer. ↗
- ·The vulnerability requires user interaction: an authenticated user must be convinced to import a malicious XML file via the 'Import Custom View' feature in Event Viewer. ↗
CVSS provenance
nvdv3.14.7MEDIUMCVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv3.05.5MEDIUMCVSS:3.0/AV:L/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N
nvdv2.04.3MEDIUMAV:N/AC:M/Au:N/C:P/I:N/A:N
vulncheck4.7MEDIUM
vendor_msrc4.7MEDIUM
CVEs like this are exactly what “Exploited This Week” covers.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-r88q-8vv9-3qmg: An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr
ghsa_unreviewed·2022-05-24
CVE-2019-0948 [MEDIUM] CWE-611 GHSA-r88q-8vv9-3qmg: An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr
An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity, aka 'Windows Event Viewer Information Disclosure Vulnerability'.
VulnCheck
Microsoft Windows Improper Restriction of XML External Entity Reference
vulncheck·2019·CVSS 4.7
CVE-2019-0948 [MEDIUM] Microsoft Windows Improper Restriction of XML External Entity Reference
Microsoft Windows Improper Restriction of XML External Entity Reference
An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.
To exploit the vulnerability, an attacker could create a file containing specially crafted XML content and convince an authenticated user to import the file.
The update addresses the vulnerability by modifying the way that the Event Viewer parses XML input.
Affected: Microsoft Windows
Required Action: Apply remediations or mitigations per vendor instructions or discontinue use of the product if remediation or mitigatio
Microsoft
Windows Event Viewer Information Disclosure Vulnerability
vendor_msrc·2019-06-11·CVSS 4.7
CVE-2019-0948 [MEDIUM] Windows Event Viewer Information Disclosure Vulnerability
Windows Event Viewer Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration.
To exploit the vulnerability, an attacker could create a file containing specially crafted XML content and convince an authenticated user to import the file.
The update addresses the vulnerability by modifying the way that the Event Viewer parses XML input.
FAQ: What type of information could be disclosed by this vulnerability?
The type of information that could be disclosed if an attacker successfully exploited this vul
No detection rules found.
2019-06-12
Published
Exploited in the wild