PT-2016-2489 · Microsoft · Edge+1

Published 2016-07-12 · Updated 2018-10-12 · CVE-2016-3274

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description The issue is related to a spoofing attack that can be conducted via a crafted URL. An attacker could exploit this to trick a user by redirecting them to a specially crafted website, which could either spoof content or serve as a pivot to chain an attack with other vulnerabilities in web services. The problem is associated with inadequate access control and improper parsing of HTTP content by the Microsoft browser.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that properly parses HTTP content to prevent spoofing attacks. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Improper Access Control

Weakness Enumeration

CWE-284

Related Identifiers

BDU:2016-01880

CVE-2016-3274

Affected Products

Edge

Internet Explorer

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2016-3274 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-085 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-3274 · Vendor Advisory
• https://bdu.fstec.ru/vul/2016-01880 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3274 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-084 · Vendor Advisory
• http://securityfocus.com/bid/91591 · Note
• http://technet.microsoft.com/security/bulletin/MS16-084 · Note
• http://securitytracker.com/id/1036283 · Note
• http://technet.microsoft.com/library/security/ms16-084 · Note
• http://technet.microsoft.com/security/bulletin/MS16-085 · Note