PT-2017-18502 · Microsoft · Internet Explorer+3

Published 2017-09-12 · Updated 2017-09-21 · CVE-2017-8736

Positive Technologies (AI Summary)

CVSS v3.1

4.3

Medium

Base vector

AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Name of the Vulnerable Software and Affected Versions Internet Explorer in Microsoft Windows versions prior to the fixed version Microsoft Edge and Internet Explorer in Windows 10 versions prior to the fixed version Microsoft Edge and Internet Explorer in Windows Server 2016 versions prior to the fixed version

Description An information disclosure issue exists in Microsoft browsers due to improper parent domain verification in certain functionality. This allows an attacker to obtain specific information used in the parent domain.

Recommendations For Internet Explorer in Microsoft Windows, update to a version that includes the fix for this issue. For Microsoft Edge and Internet Explorer in Windows 10, update to a version that includes the fix for this issue. For Microsoft Edge and Internet Explorer in Windows Server 2016, update to a version that includes the fix for this issue. As a temporary workaround, consider restricting access to sensitive information in the parent domain until a patch is available.

Fix

Information Disclosure

Weakness Enumeration

CWE-200

Related Identifiers

CVE-2017-8736

Affected Products

Edge

Internet Explorer

Windows 10

Windows Server 2016

References · 7

• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8736 · Vendor Advisory
• https://nvd.nist.gov/vuln/detail/CVE-2017-8736 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2017-8736 · Security Note
• https://osv.dev/vulnerability/CVE-2017-8736 · Vendor Advisory
• http://securityfocus.com/bid/100743 · Note
• http://securitytracker.com/id/1039343 · Note
• http://securitytracker.com/id/1039342 · Note