Summary
Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.
Details
According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message.
The CVE title says Windows Scripting Engine, what does that mean for this vulnerability?
This vulnerability impacts the JScript9 scripting engine.
Security updates
10.0.17763.5122 — https://support.microsoft.com/help/5032196
10.0.20348.2113 — https://support.microsoft.com/help/5032198
10.0.20348.2091 — https://support.microsoft.com/help/5032304
10.0.22000.2600 — https://support.microsoft.com/help/5032192
10.0.19043.3693 — https://support.microsoft.com/help/5032189
10.0.22621.2715 — https://support.microsoft.com/help/5032190
10.0.10240.20308 — https://support.microsoft.com/help/5032199
10.0.14393.6452 — https://support.microsoft.com/help/5032197
6.1.7601.26816 — https://support.microsoft.com/help/5032252
6.1.7601.26816 — https://support.microsoft.com/help/5032250
1.001 — https://support.microsoft.com/help/5032191
6.2.9200.24569 — https://support.microsoft.com/help/5032247
6.3.9600.21668 — https://support.microsoft.com/help/5032249
10.0.25398.531 — https://support.microsoft.com/help/5032202
Vulnerabilities 1
-
High 8.8CVE-2023-36017 EPSS 25%
Windows Scripting Engine Memory Corruption Vulnerability
Windows Scripting Engine Memory Corruption Vulnerability
Revision history
-
#1
Information published.
References
-
CVE-2023-36017 Windows Scripting Engine Memory Corruption Vulnerability - HTML
https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-36017
-
Microsoft Exploitability Index
https://www.microsoft.com/en-us/msrc/exploitability-index?rtc=1
-
Microsoft Support Lifecycle
https://support.microsoft.com/lifecycle
-
Common Vulnerability Scoring System
https://www.first.org/cvss