CVE-2017-0140 - Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other b

CVE-2017-0140

Summary

Microsoft Edge allows remote attackers to bypass the Same Origin Policy for HTML elements in other browser windows, aka "Microsoft Edge Security Feature Bypass Vulnerability." This vulnerability is different from those described in CVE-2017-0066 and CVE-2017-0135.

References

http://www.securityfocus.com/bid/96653
http://www.securitytracker.com/id/1038006
https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0140

Vulnerable Configurations

cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*
cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*

CVSS

Base:	4.0 (as of 03-10-2019 - 00:03)
Impact:
Exploitability:

CWE

NVD-CWE-noinfo

CAPEC

Access

Vector	Complexity	Authentication
NETWORK	HIGH	NONE

Impact

Confidentiality	Integrity	Availability
PARTIAL	PARTIAL	NONE

cvss-vector via4

AV:N/AC:H/Au:N/C:P/I:P/A:N

refmap via4

bid	96653
confirm	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0140
sectrack	1038006

Last major update

03-10-2019 - 00:03

Published

17-03-2017 - 00:59

Last modified

03-10-2019 - 00:03