EXPOSURES › CVE-2020-1380
CVE-2020-1380
HIGH ⌖ ON CISA KEV · EXPLOITEDMicrosoft Internet Explorer's scripting engine had a memory corruption flaw allowing remote code execution, which was actively exploited in the wild.
A memory corruption vulnerability in Internet Explorer's scripting engine allowed attackers to execute arbitrary code remotely in the context of the current user. DIB organizations must care because this flaw was actively exploited in the wild, indicating a failure to patch known vulnerabilities before they were weaponized. The organization should ensure all legacy browsers are disabled or patched, and prioritize patching known CVEs to prevent similar exploits.
Shame score — A known memory corruption vulnerability in a widely used browser was actively exploited in the wild, demonstrating a failure to patch known CVEs before they were weaponized.
▸ RECOMMENDED ACTION Actively exploited (CISA KEV) — remediate now, ahead of your normal patch cycle.
Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user.
"Microsoft Internet Explorer contains a memory corruption vulnerability which can allow for remote code execution in the context of the current user."
| PRODUCT | STATUS |
|---|---|
| Azure Commercial Cloud Microsoft |
Authorized |
| Azure Government (includes Dynamics 365) Microsoft |
Authorized |
| Microsoft Office 365 GCC High Microsoft |
In Process |
| Office 365 Multi-Tenant & Supporting Services Microsoft |
Authorized |