PT-2015-2346 · Microsoft · Edge

Published 2015-10-13 · Updated 2018-10-12 · CVE-2015-6058

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge (affected versions not specified)

Description The issue exists due to an error in the procedure for checking HTML attributes in Microsoft Edge, allowing a remote attacker to bypass the cross-site scripting protection mechanism. This bypass could enable initially disabled scripts to run in the wrong security context, leading to information disclosure. An attacker who successfully exploits this bypass could cause a script to run on another user's system in the guise of a third-party website, potentially taking any action on the user's system that the third-party website is permitted to take. The bypass can only be exploited if the user clicks a hypertext link, either in an HTML email or by visiting an attacker's website or a website containing content under the attacker's control.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2015-11711

CVE-2015-6058

Affected Products

Edge

References · 7

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-107 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-6058 · Security Note
• https://bdu.fstec.ru/vul/2015-11711 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2015-6058 · Security Note
• http://technet.microsoft.com/security/bulletin/ms15-107 · Note
• http://securitytracker.com/id/1033802 · Note
• http://technet.microsoft.com/security/bulletin/MS15-107 · Note