CVE-2016-7204
published 2016-11-10CVE-2016-7204: Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure…
PriorityP419low3.1CVSS 3.0
AVNACHPRNUIRSUCLINAN
EPSS
11.44%
95.5th percentile
Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability."
Affected
7 ranges
| Vendor | Product | Version range | Fixed in |
|---|---|---|---|
| msrc | microsoft_edge_on_windows_10_for_32-bit_systems | — | — |
| msrc | microsoft_edge_on_windows_10_for_x64-based_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1511_for_32-bit_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1511_for_x64-based_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1607_for_32-bit_systems | — | — |
| msrc | microsoft_edge_on_windows_10_version_1607_for_x64-based_systems | — | — |
| msrc | microsoft_edge_on_windows_server_2016 | — | — |
CVSS provenance
nvdv3.03.1LOWCVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:L/I:N/A:N
nvdv2.02.6LOWAV:N/AC:H/Au:N/C:P/I:N/A:N
vendor_msrc4.3MEDIUM
Stop checking back — get the weekly exploitation signal.
Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.
GHSA
GHSA-rp7w-g57f-q2vj: Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure Vul
ghsa_unreviewed·2022-05-14
CVE-2016-7204 [LOW] CWE-200 GHSA-rp7w-g57f-q2vj: Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure Vul
Microsoft Edge allows remote attackers to access arbitrary "My Documents" files via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability."
Microsoft
Microsoft Edge Information Disclosure Vulnerability
vendor_msrc·2016-11-08·CVSS 4.3
CVE-2016-7204 [LOW] Microsoft Edge Information Disclosure Vulnerability
Microsoft Edge Information Disclosure Vulnerability
Description: An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory. An attacker who successfully exploited this vulnerability could trick a user into allowing access to the user’s My Documents folder.
For an attack to be successful, an attacker must persuade a user to open a malicious website.
The update addresses the vulnerability by changing how Microsoft Edge handles objects in memory.
Microsoft Edge: Microsoft Edge
Impact: Information Disclosure
Exploit Status: Publicly Disclosed:No;Exploited:No;Latest Software Release:Exploitation Less Likely;Older Software Release:N/A
Reference: https://catalog.update.microsoft.com/v7/site/Search.aspx?q=KB3198585
Reference: https://catalog.upda
No detection rules found.
No public exploits indexed.
http://www.securityfocus.com/bid/93970http://www.securitytracker.com/id/1037245https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129http://www.securityfocus.com/bid/93970http://www.securitytracker.com/id/1037245https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-129
2016-11-10
Published