PT-2017-18433 · Microsoft · Windows Server 2016+10

Irsdl · Published 2017-07-11 · Updated 2017-07-19 · CVE-2017-8592

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft browsers on Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016

Description A security feature bypass issue exists due to improper handling of redirect requests by Microsoft browsers. This allows the browsers to bypass CORS redirect restrictions and follow redirect requests that should otherwise be ignored. An attacker who successfully exploits this could force the browser to send data to a destination web site of their choice.

Recommendations For Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016, update to a newer version that includes the fix for this issue. At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-8592

Affected Products

Edge

Internet Explorer

Browsers

Windows

Windows 10

Windows 7

Windows 8.1

Windows Rt 8.1

Windows Server 2008 R2

Windows Server 2012

Windows Server 2016

References · 8

• https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2017-8592 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8592 · Security Note
• https://portal.msrc.microsoft.com/en-us/security-guidance/advisory/CVE-2017-8592 · Vendor Advisory
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8592 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8592 · Vendor Advisory
• http://securitytracker.com/id/1038859 · Note
• http://securityfocus.com/bid/99396 · Note
• http://securitytracker.com/id/1038860 · Note