CVE-2017-8625 — Incorrect Default Permissions in Corporation Internet Explorer

CWE-276 — Incorrect Default Permissions7 documents6 sources
Severity
8.8HIGHNVD
EPSS
69.8%
top 1.33%
CISA KEV
Not in KEV
Exploit
No known exploits
Affected products
2
Microsoft Corporation Internet ExplorerMicrosoft Internet Explorer
Timeline
PublishedAug 8
Latest updateMay 13

Description

Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UMCI) policies due to Internet Explorer failing to validate UMCI policies, aka "Internet Explorer Security Feature Bypass Vulnerability".

CVSS vector

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:HExploitability: 2.8 | Impact: 5.9

Affected Packages2 packages

▶CVEListV5microsoft_corporation/internet_explorerWindows 10 Gold, 1511, 1607, 1703, and Windows Server 2016.

Patches

Patch: portal.msrc.microsoft.com ↗Patch: portal.msrc.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-g2g5-8m5m-xmqg: Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UM↗2022-05-13
▶
CVEList
CVE-2017-8625: Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UM↗2017-08-08
▶

📋Vendor Advisories

1
Microsoft
Internet Explorer Security Feature Bypass Vulnerability↗2017-08-08
▶

🕵️Threat Intelligence

3
Talos
Microsoft Patch Tuesday - August 2017↗2017-08-08
▶
Talos
Microsoft Patch Tuesday - August 2017↗2017-08-08
▶
Zscaler
Zscaler protects against 1 new vulnerability for IE↗
▶
CVE-2017-8625 — Incorrect Default Permissions | cvebase