PT-2015-2346 · Microsoft · Edge

Publicado 2015-10-13 · Atualizado 2018-10-12 · CVE-2015-6058

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge (affected versions not specified)

Description The issue exists due to an error in the procedure for checking HTML attributes in Microsoft Edge, allowing a remote attacker to bypass the cross-site scripting protection mechanism. This bypass could enable initially disabled scripts to run in the wrong security context, leading to information disclosure. An attacker who successfully exploits this bypass could cause a script to run on another user's system in the guise of a third-party website, potentially taking any action on the user's system that the third-party website is permitted to take. The bypass can only be exploited if the user clicks a hypertext link, either in an HTML email or by visiting an attacker's website or a website containing content under the attacker's control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

BDU:2015-11711

CVE-2015-6058

Produtos afetados

Edge

Referências · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-107 · Aviso do Fabricante
• http://technet.microsoft.com/security/bulletin/ms15-107 · Nota
• http://securitytracker.com/id/1033802 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6058 · Nota de Segurança
• https://bdu.fstec.ru/vul/2015-11711 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2015-6058 · Nota de Segurança
• http://technet.microsoft.com/security/bulletin/MS15-107 · Nota