Skip to content
skopnix
Dossier · Vulnerability

Actively exploited · CISA KEV · NVD published 2014-02-26

CVE-2013-7331

The Microsoft.XMLDOM ActiveX control in Microsoft Windows 8.1 and earlier allows remote attackers to determine the existence of local pathnames, UNC share pathnames, intranet hostnames, and intranet IP addresses by examining error codes, as demonstrated by a res:// URL, and exploited in the wild in February 2014.

  1. First PoC
  2. same day →Metasploit
  3. 481 days →First cited attacker

Signals

Exploited in the wild
Yesadded 2022-05-25 · due 2022-06-15. An observation, not a forecast.
EPSS · 30-day forecast
50%Chance of exploitation in the next 30 days, 99th percentile of all CVEs. A forecast; KEV outranks it.
CVSS · NVD · MEDIUM
6.5CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:L
Internet exposure
not stated by sourcesNo exposure census on this CVE's dispatches.

Exploits

1 known · links only

Metasploit1

  1. MS14-052 Microsoft Internet Explorer XMLDOM Filename Disclosure ↗

    This module will use the Microsoft XMLDOM object to enumerate a remote machine's filenames. It will try to do so against Internet Explorer 8 and Internet Explorer 9. To use it, you must supply your own list of file paths. Each file path should look like this: c:\windows\system32\calc.exe

    ruby · seen 2026-10-18

On the wire

0 dispatches

No dispatch on our wire has named this CVE yet.

Watch this one?

KEV additions reach Telegram and the KEV-only RSS as they land.

Follow on TelegramKEV RSSAPI

Check your stack

Paste what you run: the CVEs exploited in the wild against it, and who is cited as exploiting them, with the report.

Stack checkNo key. No signup.