PT-2018-1484 · Microsoft · Internet Explorer 10+3

James Lee + 4 · Publicado 2018-08-14 · Atualizado 2020-08-24 · CVE-2018-8351

Positive Technologies (AI Summary)

CVSS v2.0

7.8

Alta

Vetor base

AV:N/AC:L/Au:N/C:C/I:N/A:N

Name of the Vulnerable Software and Affected Versions Internet Explorer 11 Microsoft Edge Internet Explorer 10

Description The issue is related to errors in the implementation of cross-frame interaction in Microsoft browsers. It allows a remote attacker to disclose protected information using a specially crafted web page. An attacker who successfully exploits this issue could obtain browser frame or window state from a different domain.

Recommendations For Internet Explorer 11, update to a version that properly restricts cross-frame interaction. For Microsoft Edge, update to a version that properly restricts cross-frame interaction. For Internet Explorer 10, update to a version that properly restricts cross-frame interaction. As a temporary workaround, consider restricting access to sensitive information when using affected browsers until a patch is available.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

CWE-829

Identificadores relacionados

BDU:2018-01035

CVE-2018-8351

Produtos afetados

Edge

Internet Explorer

Internet Explorer 10

Internet Explorer 11

Referências · 8

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8351 · Nota de Segurança
• https://nvd.nist.gov/vuln/detail/CVE-2018-8351 · Nota de Segurança
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8351 · Aviso do Fabricante
• http://securityfocus.com/bid/105015 · Nota
• https://bdu.fstec.ru/vul/2018-01035 · Nota de Segurança
• https://support.microsoft.com/help/4343892 · Nota
• https://osv.dev/vulnerability/CVE-2018-8351 · Aviso do Fabricante
• http://securitytracker.com/id/1041457 · Nota