cnvd - cnvd-2018-24940

cnvd-2018-24940

Vulnerability from cnvd

Title: Microsoft Internet Explorer安全绕过漏洞（CNVD-2018-24940）

Description:

Microsoft Windows 10等都是美国微软（Microsoft）公司发布的一系列操作系统。Internet Explorer（IE）是一款Windows操作系统附带的Web浏览器。

Microsoft IE 11版本中存在安全功能绕过漏洞。远程攻击者可借助恶意的网站利用该漏洞访问由浏览器当前打开（或缓存）的网页的任何会话。

Severity: 中

Patch Name: Microsoft Internet Explorer安全绕过漏洞（CNVD-2018-24940）的补丁

Patch Description:

Microsoft Windows 10等都是美国微软（Microsoft）公司发布的一系列操作系统。Internet Explorer（IE）是一款Windows操作系统附带的Web浏览器。

Microsoft IE 11版本中存在安全功能绕过漏洞。远程攻击者可借助恶意的网站利用该漏洞访问由浏览器当前打开（或缓存）的网页的任何会话。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

目前厂商已发布升级补丁以修复漏洞，补丁获取链接： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470

Reference: https://www.securityfocus.com/bid/105267 https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8470

Impacted products

Name
['Microsoft Windows Server 2008 R2 SP1', 'Microsoft Windows 7 SP1', 'Microsoft Windows 8.1', 'Microsoft Windows RT 8.1 SP0', 'Microsoft Windows Server 2012 R2', 'Microsoft Windows 10', 'Microsoft Windows 10 1607', 'Microsoft Windows Server 2016', 'Microsoft Windows 10 1703', 'Microsoft Windows 10 1709', 'Microsoft Windows 10 1803']

Show details on source website

JSON

To clipboard

{
  "bids": {
    "bid": {
      "bidNumber": "105267"
    }
  },
  "cves": {
    "cve": {
      "cveNumber": "CVE-2018-8470"
    }
  },
  "description": "Microsoft Windows 10\u7b49\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u53d1\u5e03\u7684\u4e00\u7cfb\u5217\u64cd\u4f5c\u7cfb\u7edf\u3002Internet Explorer\uff08IE\uff09\u662f\u4e00\u6b3eWindows\u64cd\u4f5c\u7cfb\u7edf\u9644\u5e26\u7684Web\u6d4f\u89c8\u5668\u3002\n\nMicrosoft IE 11\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u529f\u80fd\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u7f51\u7ad9\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u7531\u6d4f\u89c8\u5668\u5f53\u524d\u6253\u5f00\uff08\u6216\u7f13\u5b58\uff09\u7684\u7f51\u9875\u7684\u4efb\u4f55\u4f1a\u8bdd\u3002",
  "discovererName": "Masato Kinugawa",
  "formalWay": "\u76ee\u524d\u5382\u5546\u5df2\u53d1\u5e03\u5347\u7ea7\u8865\u4e01\u4ee5\u4fee\u590d\u6f0f\u6d1e\uff0c\u8865\u4e01\u83b7\u53d6\u94fe\u63a5\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2018-24940",
  "openTime": "2018-12-07",
  "patchDescription": "Microsoft Windows 10\u7b49\u90fd\u662f\u7f8e\u56fd\u5fae\u8f6f\uff08Microsoft\uff09\u516c\u53f8\u53d1\u5e03\u7684\u4e00\u7cfb\u5217\u64cd\u4f5c\u7cfb\u7edf\u3002Internet Explorer\uff08IE\uff09\u662f\u4e00\u6b3eWindows\u64cd\u4f5c\u7cfb\u7edf\u9644\u5e26\u7684Web\u6d4f\u89c8\u5668\u3002\r\n\r\nMicrosoft IE 11\u7248\u672c\u4e2d\u5b58\u5728\u5b89\u5168\u529f\u80fd\u7ed5\u8fc7\u6f0f\u6d1e\u3002\u8fdc\u7a0b\u653b\u51fb\u8005\u53ef\u501f\u52a9\u6076\u610f\u7684\u7f51\u7ad9\u5229\u7528\u8be5\u6f0f\u6d1e\u8bbf\u95ee\u7531\u6d4f\u89c8\u5668\u5f53\u524d\u6253\u5f00\uff08\u6216\u7f13\u5b58\uff09\u7684\u7f51\u9875\u7684\u4efb\u4f55\u4f1a\u8bdd\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Internet Explorer\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2018-24940\uff09\u7684\u8865\u4e01",
  "products": {
    "product": [
      "Microsoft Windows Server 2008 R2 SP1",
      "Microsoft Windows 7 SP1",
      "Microsoft Windows 8.1",
      "Microsoft Windows RT 8.1 SP0",
      "Microsoft Windows Server 2012 R2",
      "Microsoft Windows 10",
      "Microsoft Windows 10 1607",
      "Microsoft Windows Server 2016",
      "Microsoft Windows 10 1703",
      "Microsoft Windows 10 1709",
      "Microsoft Windows 10 1803"
    ]
  },
  "referenceLink": "https://www.securityfocus.com/bid/105267\r\nhttps://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2018-8470",
  "serverity": "\u4e2d",
  "submitTime": "2018-09-12",
  "title": "Microsoft Internet Explorer\u5b89\u5168\u7ed5\u8fc7\u6f0f\u6d1e\uff08CNVD-2018-24940\uff09"
}

CVE-2018-8470 (GCVE-0-2018-8470)

Vulnerability from cvelistv5

Published

2018-09-13 00:00

Modified

2024-08-05 06:54

Severity ?

CWE

Security Feature Bypass

Summary

A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka "Internet Explorer Security Feature Bypass Vulnerability." This affects Internet Explorer 11.

References

▼	URL	Tags
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470	x_refsource_CONFIRM
	http://www.securitytracker.com/id/1041632	vdb-entry, x_refsource_SECTRACK
	http://www.securityfocus.com/bid/105267	vdb-entry, x_refsource_BID

Impacted products

	Vendor	Product	Version
	Microsoft	Internet Explorer 11	Version: Windows 10 for 32-bit Systems Version: Windows 10 for x64-based Systems Version: Windows 10 Version 1607 for 32-bit Systems Version: Windows 10 Version 1607 for x64-based Systems Version: Windows 10 Version 1703 for 32-bit Systems Version: Windows 10 Version 1703 for x64-based Systems Version: Windows 10 Version 1709 for 32-bit Systems Version: Windows 10 Version 1709 for x64-based Systems Version: Windows 10 Version 1803 for 32-bit Systems Version: Windows 10 Version 1803 for x64-based Systems Version: Windows 7 for 32-bit Systems Service Pack 1 Version: Windows 7 for x64-based Systems Service Pack 1 Version: Windows 8.1 for 32-bit systems Version: Windows 8.1 for x64-based systems Version: Windows RT 8.1 Version: Windows Server 2008 R2 for x64-based Systems Service Pack 1 Version: Windows Server 2012 R2 Version: Windows Server 2016

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T06:54:36.666Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470"
          },
          {
            "name": "1041632",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1041632"
          },
          {
            "name": "105267",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105267"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Internet Explorer 11",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Windows 10 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1607 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1607 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1703 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1703 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 7 for 32-bit Systems Service Pack 1"
            },
            {
              "status": "affected",
              "version": "Windows 7 for x64-based Systems Service Pack 1"
            },
            {
              "status": "affected",
              "version": "Windows 8.1 for 32-bit systems"
            },
            {
              "status": "affected",
              "version": "Windows 8.1 for x64-based systems"
            },
            {
              "status": "affected",
              "version": "Windows RT 8.1"
            },
            {
              "status": "affected",
              "version": "Windows Server 2008 R2 for x64-based Systems Service Pack 1"
            },
            {
              "status": "affected",
              "version": "Windows Server 2012 R2"
            },
            {
              "status": "affected",
              "version": "Windows Server 2016"
            }
          ]
        }
      ],
      "datePublic": "2018-09-12T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka \"Internet Explorer Security Feature Bypass Vulnerability.\" This affects Internet Explorer 11."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Security Feature Bypass",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-09-13T09:57:01",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470"
        },
        {
          "name": "1041632",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1041632"
        },
        {
          "name": "105267",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105267"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2018-8470",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Internet Explorer 11",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Windows 10 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1607 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1607 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1703 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1703 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 7 for 32-bit Systems Service Pack 1"
                          },
                          {
                            "version_value": "Windows 7 for x64-based Systems Service Pack 1"
                          },
                          {
                            "version_value": "Windows 8.1 for 32-bit systems"
                          },
                          {
                            "version_value": "Windows 8.1 for x64-based systems"
                          },
                          {
                            "version_value": "Windows RT 8.1"
                          },
                          {
                            "version_value": "Windows Server 2008 R2 for x64-based Systems Service Pack 1"
                          },
                          {
                            "version_value": "Windows Server 2012 R2"
                          },
                          {
                            "version_value": "Windows Server 2016"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "A security feature bypass vulnerability exists in Internet Explorer due to how scripts are handled that allows a universal cross-site scripting (UXSS) condition, aka \"Internet Explorer Security Feature Bypass Vulnerability.\" This affects Internet Explorer 11."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Security Feature Bypass"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8470"
            },
            {
              "name": "1041632",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1041632"
            },
            {
              "name": "105267",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105267"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2018-8470",
    "datePublished": "2018-09-13T00:00:00",
    "dateReserved": "2018-03-14T00:00:00",
    "dateUpdated": "2024-08-05T06:54:36.666Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted