CVE-2017-0011 — Sensitive Information Exposure in Corporation Browser

CWE-200 — Sensitive Information ExposureCWE-79 — Cross-site Scripting25 documents8 sources
Severity
6.1MEDIUMNVD
NVD4.3CNA4.3VulnCheck4.3
EPSS
8.4%
top 7.65%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
3
Microsoft Corporation BrowserMicrosoft Corporation EdgeMicrosoft Internet Explorer
Timeline
PublishedMar 17
Latest updateMay 17

Description

Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerability." This vulnerability is different from those described in CVE-2017-0009, CVE-2017-0017, CVE-2017-0065, and CVE-2017-0068.

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:NExploitability: 2.8 | Impact: 1.4

Affected Packages3 packages

▶CVEListV5microsoft_corporation/edgeEdge, The RegEx class in the XSS filter in Microsoft Edge+1
▶CVEListV5microsoft_corporation/browserInternet Explorer 9 through 11 and Edge

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

11
GHSA
GHSA-qh2j-hcp8-r23w: The RegEx class in the XSS filter in Microsoft Edge allows remote attackers to conduct cross-site scripting (XSS) attacks and obtain sensitive informa↗2022-05-17
▶
GHSA
GHSA-53gv-m53j-xw4v: Microsoft Internet Explorer 9 through 11 allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Micro↗2022-05-17
▶
GHSA
GHSA-322g-5x7j-7fgm: Microsoft Edge allows remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Edge Information Disclosure Vulnerabilit↗2022-05-17
▶
GHSA
GHSA-33q8-hj9q-xc35: Browsers in Microsoft Edge allow remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Edge Info↗2022-05-17
▶
GHSA
GHSA-m792-56jx-j3hj: Microsoft Edge allows remote attackers to obtain sensitive information from process memory via a crafted web site, aka "Microsoft Browser Information↗2022-05-17
▶

📋Vendor Advisories

1
Microsoft
Microsoft Browser Information Disclosure Vulnerability↗2017-03-14
▶

🕵️Threat Intelligence

7
Trendmicro
March 2017 Patch Tuesday: 18 Security Bulletins↗2017-03-15
▶
Trendmicro
March 2017 Patch Tuesday: 18 Security Bulletins↗2017-03-15
▶
Trendmicro
March 2017 Patch Tuesday: 18 Security Bulletins↗2017-03-15
▶
Trendmicro
March 2017 Patch Tuesday: 18 Security Bulletins↗2017-03-15
▶
Trendmicro
March 2017 Patch Tuesday: 18 Security Bulletins↗2017-03-15
▶

💬Community

1
Bugzilla
CVE-2017-7489 CVE-2017-7490 CVE-2017-7491 moodle: Multiple security vulnerabilities↗2017-05-17
▶
CVE-2017-0011 — Sensitive Information Exposure | cvebase