PT-2017-18381 · Microsoft · Windows Server 2016+2

Publicado 2017-06-13 · Atualizado 2017-06-21 · CVE-2017-8504

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge versions in Windows 10 1607 and 1703, and Windows Server 2016

Description An information disclosure issue exists due to the Microsoft Edge Fetch API incorrectly handling a filtered response type. This allows an attacker to read the URL of a cross-origin request. Websites that do not securely populate the URL with confidential information could allow information to be disclosed to an attacker.

Recommendations For Microsoft Edge in Windows 10 1607 and 1703, and Windows Server 2016, consider restricting access to sensitive information in URLs to minimize the risk of exploitation. As a temporary workaround, consider disabling the use of the Fetch API for cross-origin requests until a patch is available. Avoid using the Fetch API to handle confidential information in URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-8504

Produtos afetados

Edge

Windows 10

Windows Server 2016

Referências · 4

• https://nvd.nist.gov/vuln/detail/CVE-2017-8504 · Nota de Segurança
• http://securityfocus.com/bid/98892 · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8504 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8504 · Aviso do Fabricante