What is the CVSS score of CVE-2019-0948?

CVE-2019-0948 has a CVSS 3.1 base score of 4.7 (Medium). CVSS vector: CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N. EPSS exploitation probability: 12.7%.

Is there a public PoC exploit available for CVE-2019-0948?

Yes, a public proof-of-concept exploit is available for CVE-2019-0948. Prioritise patching immediately. EPSS: 12.7%.

Is there a patch available for CVE-2019-0948?

Yes, a patch is available for CVE-2019-0948. Update the affected software to the latest version immediately.

Windows 10 CVE-2019-0948

MEDIUM

Improper Restriction of XML External Entity Reference (CWE-611)

2019-06-12 secure@microsoft.com

XXE Microsoft Information Disclosure Windows 10 Windows 7 Windows 8 1 Windows Rt 8 1 Windows Server 2008 Windows Server 2012 Windows Server 2016 Windows Server 2019

4.7

CVSS 3.1 · Vendor: microsoft

Severity by source

Vendor (microsoft) PRIMARY

4.7 MEDIUM

AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Primary rating from Vendor (microsoft) · only source for this CVE.

CVSS VectorVendor: microsoft

CVSS:3.1/AV:L/AC:H/PR:N/UI:R/S:U/C:H/I:N/A:N

Attack Vector

Local

Attack Complexity

High

Privileges Required

None

User Interaction

Required

Scope

Unchanged

Confidentiality

High

Integrity

None

Availability

None

Lifecycle Timeline

CVE Published

Jun 12, 2019 - 14:29 cve.org

MEDIUM 4.7

DescriptionCVE.org

An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration. To exploit the vulnerability, an attacker could create a file containing specially crafted XML content and convince an authenticated user to import the file. The update addresses the vulnerability by modifying the way that the Event Viewer parses XML input.

AnalysisAI

An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. Rated medium severity (CVSS 4.7), this vulnerability is no authentication required. This XML External Entity (XXE) vulnerability could allow attackers to read arbitrary files or perform SSRF through XML processing.

Technical ContextAI

This vulnerability is classified as XML External Entity (XXE) (CWE-611), which allows attackers to read arbitrary files or perform SSRF through XML processing. An information disclosure vulnerability exists in the Windows Event Viewer (eventvwr.msc) when it improperly parses XML input containing a reference to an external entity. An attacker who successfully exploited this vulnerability could read arbitrary files via an XML external entity (XXE) declaration. To exploit the vulnerability, an attacker could create a file containing specially crafted XML content and convince an authenticated user to import the file. The update addresses the vulnerability by modifying the way that the Event Viewer parses XML input. Affected products include: Microsoft Windows 10, Microsoft Windows 7, Microsoft Windows 8.1, Microsoft Windows Rt 8.1, Microsoft Windows Server 2008.

RemediationAI

A vendor patch is available. Apply the latest security update as soon as possible. Disable external entity processing in XML parsers, use JSON instead of XML where possible.