CVE-2019-1367

This vulnerability is like a “trapdoor” in Internet Explorer’s scripting engine. If someone lures you into opening a specially crafted webpage, the browser can be tricked into running attacker code on your computer. That can lead to ransomware or other malware installing itself without you realizing it.

This matters if your business uses Internet Explorer on affected Windows versions (including Internet Explorer 11 on Windows Server 2012 and Windows 10, including 1903 variants). The key risk is that an attacker can’t exploit it without getting a user to open malicious content in Internet Explorer while it’s running. The practical reachability condition is: only when Internet Explorer is reachable for browsing and an attacker-delivered page is opened—there’s no extra login required to trigger the flaw.

This is RED because CISA listed CVE-2019-1367 in the KEV catalog as being used in real ransomware campaigns. Attackers have already demonstrated the ability to weaponize this class of flaw, so waiting increases the chance of a successful compromise. Focus on updating or removing Internet Explorer usage immediately on all devices where it’s installed and used.

1. Identify exposure on your endpoints

   • Inventory Windows devices where Internet Explorer or Internet Explorer 11 is installed and actually used by staff.
   • Pay special attention to machines used for web-based workflows (ERP portals, internal sites, third-party/vendor websites) where staff may still browse using Internet Explorer.

2. Confirm patch status

   • Ensure Windows Update is enabled and that Microsoft security updates are being applied.
   • Use Microsoft’s guidance linked in the vendor remediation for CVE-2019-1367 to verify that your installed update level matches what Microsoft says is fixed.

3. Apply remediation

   • If Microsoft guidance indicates an update is required for your specific Windows build, install it.
   • If you cannot reliably patch immediately, disable or strongly restrict Internet Explorer usage:
     • Ensure users use a supported browser for daily browsing.
     • Restrict launching Internet Explorer where possible, and limit access for users who don’t need it.

4. Compensating controls while patching

   • Reduce the likelihood that staff open untrusted links in Internet Explorer (e.g., block or warn on suspicious URLs, restrict where possible).
   • For any systems that must keep Internet Explorer for compatibility, prioritize those for updates first.

5. What to monitor

   • Look for signs of compromise after any suspicious browsing incident (unusual processes, unexpected new scheduled tasks/services, or abnormal network connections).

6. Timeline note (from KEV)

   • CISA’s KEV listed a remediation due date of 2022-05-03 for applying vendor updates. Given this is already in KEV, treat remediation as overdue for any still-unpatched systems.

7. After remediation

   • Re-check that Internet Explorer is not used where avoidable, and verify the update state remains current over time.

Severity/impact: The issue is classified as Remote Code Execution with high severity (CWE-787: out-of-bounds or memory handling issues leading to memory corruption). Attack vector is network-based and requires the attacker to get a user to open a specially crafted webpage while Internet Explorer is running; there is no authentication required.

Exploitation status: Listed in CISA KEV (added 2021-11-03) as used in ransomware campaigns, meaning real-world exploitation has been observed. No public exploit code was found/recorded in the provided findings.

Weakness mechanics: The scripting engine mishandles objects in memory, leading to memory corruption. Under the right conditions, this can be steered to execute arbitrary attacker code.

Exploit maturity: Weaponized enough to appear in ransomware activity per KEV; public exploit code not indicated by the provided findings.

EPSS: A prediction exists (45.0% with a falling trend), but since KEV confirms real-world use, this prediction is not the driver for urgency.

KEV meaning here: CISA KEV entries represent vulnerabilities that have been confirmed exploited in the wild, and they come with an expectation that organizations apply the vendor remediation guidance.