PT-2016-2929 · Microsoft · Edge+1

Published 2016-11-08 · Updated 2018-10-12 · CVE-2016-7239

Positive Technologies (AI Summary)

CVSS v3.1

3.1

Low

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description The issue allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive information via unspecified vectors. An information disclosure vulnerability exists when the Microsoft browser XSS filter is abused to leak sensitive page information. An attacker who successfully exploited the issue could obtain sensitive information from certain web pages. To exploit the issue, an attacker would have to log on to an affected system.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that includes the fix for this issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

Information Disclosure

XSS

Weakness Enumeration

CWE-200

CWE-79

Related Identifiers

BDU:2016-02360

CVE-2016-7239

Affected Products

Edge

Internet Explorer

References · 11

• https://nvd.nist.gov/vuln/detail/CVE-2016-7239 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-142 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7239 · Security Note
• https://bdu.fstec.ru/vul/2016-02360 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7239 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS16-129 · Note
• http://securityfocus.com/bid/94059 · Note
• http://technet.microsoft.com/library/security/MS16-142 · Note
• http://securitytracker.com/id/1037245 · Note
• http://technet.microsoft.com/security/bulletin/MS16-142 · Note