PT-2016-3013 · Microsoft · Edge+1

Published 2016-12-13 · Updated 2018-10-12 · CVE-2016-7281

Positive Technologies (AI Summary)

CVSS v3.1

5.3

Medium

Base vector

AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 10 through 11 Microsoft Edge (affected versions not specified)

Description A security feature bypass issue exists due to incorrect application of the Same Origin Policy for scripts running inside Web Workers, allowing remote attackers to bypass the policy via unspecified vectors. This issue is related to errors in security settings.

Recommendations For Microsoft Internet Explorer versions 10 through 11, update the browser to apply the necessary security patches. For Microsoft Edge, at the moment, there is no information about a newer version that contains a fix for this vulnerability.

Weakness Enumeration

CWE-254

Related Identifiers

BDU:2017-00097

CVE-2016-7281

Affected Products

Edge

Internet Explorer

References · 11

• https://bdu.fstec.ru/vul/2017-00097 · Security Note
• https://osv.dev/vulnerability/CVE-2016-7281 · Vendor Advisory
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-145 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2016-7281 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-7281 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-144 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/MS16-145 · Note
• http://technet.microsoft.com/security/bulletin/MS16-144 · Note
• http://securitytracker.com/id/1037444 · Note
• http://securityfocus.com/bid/94723 · Note
• http://technet.microsoft.com/library/security/MS16-144 · Note