PT-2017-18502 · Microsoft · Internet Explorer+3

Publicado 2017-09-12 · Atualizado 2017-09-21 · CVE-2017-8736

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Internet Explorer in Microsoft Windows versions prior to the fixed version Microsoft Edge and Internet Explorer in Windows 10 versions prior to the fixed version Microsoft Edge and Internet Explorer in Windows Server 2016 versions prior to the fixed version

Description An information disclosure issue exists in Microsoft browsers due to improper parent domain verification in certain functionality. This allows an attacker to obtain specific information used in the parent domain.

Recommendations For Internet Explorer in Microsoft Windows, update to a version that includes the fix for this issue. For Microsoft Edge and Internet Explorer in Windows 10, update to a version that includes the fix for this issue. For Microsoft Edge and Internet Explorer in Windows Server 2016, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive information in the parent domain until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2017-8736

Produtos afetados

Edge

Internet Explorer

Windows 10

Windows Server 2016

Referências · 7

• http://securityfocus.com/bid/100743 · Nota
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8736 · Aviso do Fabricante
• https://nvd.nist.gov/vuln/detail/CVE-2017-8736 · Nota de Segurança
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8736 · Nota de Segurança
• http://securitytracker.com/id/1039343 · Nota
• http://securitytracker.com/id/1039342 · Nota
• https://osv.dev/vulnerability/CVE-2017-8736 · Aviso do Fabricante