PT-2020-4154 · Microsoft · Internet Explorer+1

Hao Li · Published 2020-09-08 · Updated 2024-07-26 · CVE-2020-0878

Positive Technologies (AI Summary)

CVSS v2.0

5.1

Medium

Base vector

AV:N/AC:H/Au:N/C:P/I:P/A:P

Name of the Vulnerable Software and Affected Versions: Microsoft Edge and Internet Explorer (affected versions not specified)

Description: A remote code execution issue exists in the way Microsoft browsers access objects in memory, potentially allowing an attacker to execute arbitrary code in the context of the current user. This could enable the attacker to gain the same user rights as the current user. If the current user has administrative rights, the attacker could take control of the affected system, install programs, view, change, or delete data, or create new accounts with full user rights. The vulnerability can be exploited through specially crafted websites that users are convinced to visit, or through compromised websites that host user-provided content or advertisements with specially crafted content.

Recommendations: At the moment, there is no information about a newer version that contains a fix for this vulnerability.

RCE

Buffer Overflow

Memory Corruption

Weakness Enumeration

CWE-119

CWE-787

Related Identifiers

BDU:2020-04576

CVE-2020-0878

Affected Products

Edge

Internet Explorer

References · 9

• https://nvd.nist.gov/vuln/detail/CVE-2020-0878 · Security Note
• https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2020-0878 · Vendor Advisory
• https://safe-surf.ru/specialists/bulletins-nkcki/656711 · Security Note
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-0878 · Security Note
• https://osv.dev/vulnerability/CVE-2020-0878 · Vendor Advisory
• https://bdu.fstec.ru/vul/2020-04576 · Security Note
• https://cisa.gov/sites/default/files/csv/known_exploited_vulnerabilities.csv · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog · Note
• https://cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2020-0878 · Note