Skip to content
OpenAdvisories
High MSRC-CVE-2023-36017 1 CVE

Windows Scripting Engine Memory Corruption Vulnerability

Published Nov 14, 2023 · Updated Nov 14, 2023

Summary

Impact: Remote Code Execution. Microsoft rating: Important. Not known to be exploited — Exploitation More Likely. Customer action: Required.

Details

According to the CVSS metric, user interaction is required (UI:R). What interaction would the user have to do?
This vulnerability requires that a user with an affected version of Windows access a malicious server. An attacker would have to host a specially crafted server share or website. An attacker would have no way to force users to visit this specially crafted server share or website, but would have to convince them to visit the server share or website, typically by way of an enticement in an email or chat message.

The CVE title says Windows Scripting Engine, what does that mean for this vulnerability?
This vulnerability impacts the JScript9 scripting engine.

Security updates
10.0.17763.5122 — https://support.microsoft.com/help/5032196
10.0.20348.2113 — https://support.microsoft.com/help/5032198
10.0.20348.2091 — https://support.microsoft.com/help/5032304
10.0.22000.2600 — https://support.microsoft.com/help/5032192
10.0.19043.3693 — https://support.microsoft.com/help/5032189
10.0.22621.2715 — https://support.microsoft.com/help/5032190
10.0.10240.20308 — https://support.microsoft.com/help/5032199
10.0.14393.6452 — https://support.microsoft.com/help/5032197
6.1.7601.26816 — https://support.microsoft.com/help/5032252
6.1.7601.26816 — https://support.microsoft.com/help/5032250
1.001 — https://support.microsoft.com/help/5032191
6.2.9200.24569 — https://support.microsoft.com/help/5032247
6.3.9600.21668 — https://support.microsoft.com/help/5032249
10.0.25398.531 — https://support.microsoft.com/help/5032202

Vulnerabilities 1

Revision history

  1. #1

    Information published.

References