Vulnerability Name:

CVE-2018-0989

Assigned:2017-12-01
Published:2018-04-10
Updated:2018-04-12
Summary:An information disclosure vulnerability exists in the way that the scripting engine handles objects in memory in Internet Explorer, aka "Scripting Engine Information Disclosure Vulnerability." This affects Internet Explorer 9, Internet Explorer 11, Internet Explorer 10. This CVE ID is unique from CVE-2018-0981, CVE-2018-0987, CVE-2018-1000.
CVSS v3 Severity:4.3 Medium (CCN CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N)
3.9 Low (CCN Temporal CVSS v3 Vector: CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N/E:P/RL:O/RC:C)
Exploitability Metrics:Attack Vector (AV): Network
Attack Complexity (AC): Low
Privileges Required (PR): None
User Interaction (UI): Required
Scope:Scope (S): Unchanged
Impact Metrics:Confidentiality (C): Low
Integrity (I): None
Availibility (A): None
CVSS v2 Severity:4.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:S/C:P/I:N/A:N)
Exploitability Metrics:Access Vector (AV): Network
Access Complexity (AC): Low
Athentication (Au): Single_Instance
Impact Metrics:Confidentiality (C): Partial
Integrity (I): None
Availibility (A): None
References:Source: BID
Type: UNKNOWN
103624

Source: SECTRACK
Type: UNKNOWN
1040653

Source: XF
Type: UNKNOWN
ms-ie-cve20180989-info-disc(140793)

Source: CONFIRM
Type: UNKNOWN
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-0989

Vulnerable Configuration:
Configuration CCN 1:
  • cpe:/a:microsoft:internet_explorer:9:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
  • OR cpe:/a:microsoft:internet_explorer:11:-:*:*:*:*:*:*
  • AND
  • cpe:/o:microsoft:windows_server:2008:sp2:x32:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server:2008:sp2:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:-:sp1:x32:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_7:-:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2008:r2:sp1:x64:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_server_2012:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_8.1:-:-:-:*:-:-:x64:*
  • OR cpe:/o:microsoft:windows_server_2012:r2:-:-:*:datacenter:*:*:*
  • OR cpe:/o:microsoft:windows_rt_8.1:-:*:*:*:*:*:*:*
  • OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x32:*
  • OR cpe:/o:microsoft:windows_10:-:*:*:*:*:*:x64:*
  • OR cpe:/o:microsoft:windows_server_2016:-:*:*:*:*:*:*:*

  • Denotes that component is vulnerable
    BACK
    microsoft internet explorer 9
    microsoft internet explorer 10
    microsoft internet explorer 11 -
    microsoft windows server 2008 sp2
    microsoft windows server 2008 sp2
    microsoft windows 7 - sp1
    microsoft windows 7 - sp1
    microsoft windows server 2008 r2 sp1
    microsoft windows server 2012 -
    microsoft windows 8.1 - -
    microsoft windows server 2012 r2 -
    microsoft windows rt 8.1 -
    microsoft windows 10 -
    microsoft windows 10 -
    microsoft windows server 2016 -