Actively exploited · Published Oct 9, 2013 · Assigned by microsoft

CVE-2013-3896

Medium 5.5 Exploited

In plain English

A medium-severity security flaw in Silverlight from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on May 25, 2022). The chance it is exploited in the next 30 days is estimated at 68.0% (higher than 99.3% of all known vulnerabilities). Ready-made attack tooling exists: Metasploit. The impacted product is end-of-life and should be disconnected if still in use.

Severity (CVSS 3.1)5.5Medium

Exploit odds (30 days)68.0%top 0.7% of all CVEs

Exploited in the wildYesCISA KEV since May 25, 2022

Attack tooling1Metasploit

CISA guidance

The impacted product is end-of-life and should be disconnected if still in use.

Federal agencies must remediate by Jun 15, 2022.

Official description

Microsoft Silverlight 5 before 5.1.20913.0 does not properly validate pointers during access to Silverlight elements, which allows remote attackers to obtain sensitive information via a crafted Silverlight application, aka "Silverlight Vulnerability."

Affected products (as reported)

Vendor	Product	Versions
n/a	n/a	n/a

References

MS13-087 vendor-advisory, x_refsource_MS
oval:org.mitre.oval:def:19003 vdb-entry, signature, x_refsource_OVAL
TA13-288A third-party-advisory, x_refsource_CERT
oval:org.mitre.oval:def:19055 vdb-entry, signature, x_refsource_OVAL
https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2013-3896 government-resource