PT-2016-1681 · Microsoft · Edge

Lokihardt · Publicado 2016-04-12 · Atualizado 2018-10-12 · CVE-2016-0158

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge (affected versions not specified)

Description The issue is related to errors in security settings, allowing a remote attacker to bypass existing access restriction policies. It is an elevation of privilege vulnerability that occurs when Microsoft Edge does not properly enforce cross-domain policies. This could allow an attacker to access information from one domain and inject it into another domain. However, it does not allow arbitrary code to be run on its own. The vulnerability could be used in conjunction with another vulnerability, such as a remote code execution vulnerability, to take advantage of elevated privileges when running arbitrary code.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-254

Identificadores relacionados

BDU:2016-01007

CVE-2016-0158

ZDI-16-233

Produtos afetados

Edge

Referências · 9

• https://bdu.fstec.ru/vul/2016-01007 · Nota de Segurança
• http://securitytracker.com/id/1035522 · Nota
• http://technet.microsoft.com/security/bulletin/MS16-038 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2016-0158 · Nota de Segurança
• http://zerodayinitiative.com/advisories/ZDI-16-233 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-038 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-0158 · Nota de Segurança
• https://zerodayinitiative.com/advisories/ZDI-16-233 · Nota de Segurança
• http://technet.microsoft.com/library/security/ms16-038 · Nota