PT-2017-10469 · Microsoft · Edge

Published 2017-05-09 · Updated 2019-10-03 · CVE-2017-0241

Positive Technologies (AI Summary)

CVSS v2.0

5.4

Medium

Base vector

AV:N/AC:H/Au:N/C:N/I:C/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Edge (affected versions not specified)

Description The issue arises when Microsoft Edge renders a domain-less page in the URL. This could allow Microsoft Edge to perform actions in the context of the Intranet Zone and access functionality that is not typically available to the browser when browsing in the context of the Internet Zone. To exploit the issue, an attacker would have to convince a user to browse to a maliciously created webpage.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2017-0241

Affected Products

Edge

References · 4

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0241 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-0241 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0241 · Security Note
• http://securityfocus.com/bid/98208 · Note