PT-2017-1633 · Microsoft · Edge+1

Published 2017-03-14 · Updated 2017-07-12 · CVE-2017-0033

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Internet Explorer versions (affected versions not specified) Microsoft Edge versions (affected versions not specified)

Description The issue exists due to insufficient input validation in Microsoft browsers. An attacker could exploit this by using a specially crafted website to spoof web content. This could be achieved by redirecting a user to the crafted site, potentially allowing the attacker to trick the user into taking unintended actions. The exploitation requires the user to click on a specially crafted URL.

Recommendations For Internet Explorer, as a temporary workaround, consider restricting access to untrusted websites until a patch is available. For Microsoft Edge, avoid clicking on suspicious or specially crafted URLs until the issue is resolved. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Weakness Enumeration

CWE-20

Related Identifiers

BDU:2017-00786

CVE-2017-0033

Affected Products

Edge

Internet Explorer

References · 9

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0033 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-0033 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2017-0033 · Security Note
• https://osv.dev/vulnerability/CVE-2017-0033 · Vendor Advisory
• https://bdu.fstec.ru/vul/2017-00786 · Security Note
• http://technet.microsoft.com/library/security/MS17-007 · Note
• http://securityfocus.com/bid/96087 · Note
• http://securitytracker.com/id/1038006 · Note
• http://technet.microsoft.com/library/security/MS17-006 · Note