⚠ Actively exploited in ransomware campaigns
This vulnerability is on the CISA Known Exploited Vulnerabilities list and has been used in known ransomware attacks. CISA required action: Apply updates per vendor instructions.. Due date: 2022-06-14.
CVE-2016-3351 — Sensitive Information Exposure in Microsoft Internet Explorer
Severity
6.5MEDIUMNVD
EPSS
40.3%
top 2.64%
CISA KEV
KEVRansomware
Added 2022-05-24
Due 2022-06-14
Exploit
Exploited in wild
Active exploitation observed
Affected products
Timeline
PublishedSep 14
KEV addedMay 24
KEV dueJun 14
Latest updateOct 10
CISA Required Action: Apply updates per vendor instructions.
Description
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
CVSS vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:NExploitability: 2.8 | Impact: 3.6
Affected Packages1 packages
Patches
🔴Vulnerability Details
3GHSA▶
GHSA-p53p-2wmf-238v: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Micros↗2022-05-14
CVEList▶
CVE-2016-3351: Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Micros↗2016-09-14