PT-2017-1633 · Microsoft · Edge+1

Publicado 2017-03-14 · Atualizado 2017-07-12 · CVE-2017-0033

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Internet Explorer versions (affected versions not specified) Microsoft Edge versions (affected versions not specified)

Description The issue exists due to insufficient input validation in Microsoft browsers. An attacker could exploit this by using a specially crafted website to spoof web content. This could be achieved by redirecting a user to the crafted site, potentially allowing the attacker to trick the user into taking unintended actions. The exploitation requires the user to click on a specially crafted URL.

Recommendations For Internet Explorer, as a temporary workaround, consider restricting access to untrusted websites until a patch is available. For Microsoft Edge, avoid clicking on suspicious or specially crafted URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Enumeração de Fraquezas

CWE-20

Identificadores relacionados

BDU:2017-00786

CVE-2017-0033

Produtos afetados

Edge

Internet Explorer

Referências · 9

• http://technet.microsoft.com/library/security/MS17-007 · Nota
• http://securityfocus.com/bid/96087 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0033 · Aviso do Fabricante
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0033 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2017-0033 · Nota de Segurança
• https://osv.dev/vulnerability/CVE-2017-0033 · Aviso do Fabricante
• http://securitytracker.com/id/1038006 · Nota
• http://technet.microsoft.com/library/security/MS17-006 · Nota
• https://bdu.fstec.ru/vul/2017-00786 · Nota de Segurança