Vulnerabilities > CVE-2017-0066 - Security Bypass vulnerability in Microsoft Edge

047910
CVSS 4.0 - MEDIUM
Attack vector
NETWORK
Attack complexity
HIGH
Privileges required
NONE
Confidentiality impact
PARTIAL
Integrity impact
PARTIAL
Availability impact
NONE
network
high complexity
microsoft
nessus

Summary

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0135 and CVE-2017-0140.

Vulnerable Configurations

Part Description Count
Application
Microsoft
1

Msbulletin

bulletin_idMS17-007
bulletin_url
date2017-03-14T00:00:00
impactRemote Code Execution
knowledgebase_id4013071
knowledgebase_url
severityCritical
titleCumulative Security Update for Microsoft Edge

Nessus

NASL familyWindows : Microsoft Bulletins
NASL idSMB_NT_MS17-007.NASL
descriptionThe version of Microsoft Edge installed on the remote Windows host is missing Cumulative Security Update 4013071. It is, therefore, affected by multiple vulnerabilities, including remote code execution vulnerabilities. An unauthenticated, remote attacker can exploit these vulnerabilities by convincing a user to visit a specially crafted website, resulting in the execution of arbitrary code in the context of the current user. Note that in order to be fully protected from CVE-2017-0071, Microsoft recommends the July 2017 security updates to be installed.
last seen2020-06-01
modified2020-06-02
plugin id97730
published2017-03-14
reporterThis script is Copyright (C) 2017-2019 and is owned by Tenable, Inc. or an Affiliate thereof.
sourcehttps://www.tenable.com/plugins/nessus/97730
titleMS17-007: Cumulative Security Update for Microsoft Edge (4013071)