PT-2016-3012 · Microsoft · Edge+1

Published 2016-12-13 · Updated 2018-10-12 · CVE-2016-7282

Positive Technologies (AI Summary)

CVSS v3.1

6.1

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 9 through 11 Microsoft Edge (affected versions not specified)

Description A cross-site scripting (XSS) issue allows remote attackers to inject arbitrary web script or HTML via unspecified vectors. This is due to the browsers not taking measures to protect the structure of web pages, which could enable a remote attacker to inject arbitrary code. The vulnerability exists because Microsoft Browsers do not properly validate content under specific conditions, and the affected component does not handle objects in memory correctly. An attacker who exploits this issue could run arbitrary code, leading to information disclosure, and potentially obtain information to further compromise a target system.

Recommendations For Microsoft Internet Explorer versions 9 through 11, update to a version that includes the fix for this issue. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

XSS

Weakness Enumeration

CWE-79

Related Identifiers

BDU:2017-00096

CVE-2016-7282

Affected Products

Edge

Internet Explorer

References · 12

• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7282 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2016-7282 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145 · Vendor Advisory
• https://osv.dev/vulnerability/CVE-2016-7282 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00096 · Security Note
• http://technet.microsoft.com/library/security/MS16-145 · Note
• http://technet.microsoft.com/security/bulletin/MS16-145 · Note
• http://technet.microsoft.com/security/bulletin/MS16-144 · Note
• http://securitytracker.com/id/1037444 · Note
• http://securityfocus.com/bid/94724 · Note
• http://technet.microsoft.com/library/security/MS16-144 · Note