cnvd - cnvd-2019-02493

cnvd-2019-02493

Vulnerability from cnvd

Title: Microsoft Edge权限提升漏洞（CNVD-2019-02493）

Description:

Edge是微软为Windows 10打造的浏览器，特点是快速、安全。

Microsoft Edge存在权限提升漏洞。该漏洞源于Microsoft Edge未能正确实施跨域策略，攻击者可利用该漏洞从一个域访问信息并将其注入另一个域。

Severity: 中

Patch Name: Microsoft Edge权限提升漏洞（CNVD-2019-02493）的补丁

Patch Description:

Edge是微软为Windows 10打造的浏览器，特点是快速、安全。

Microsoft Edge存在权限提升漏洞。该漏洞源于Microsoft Edge未能正确实施跨域策略，攻击者可利用该漏洞从一个域访问信息并将其注入另一个域。目前，供应商发布了安全公告及相关补丁信息，修复了此漏洞。

Formal description:

厂商已发布漏洞修复程序，请及时关注更新： https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567

Reference: https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567 https://www.securityfocus.com/bid/105784

Impacted products

Name
Microsoft Edge 无

Show details on source website

JSON

To clipboard

{
  "cves": {
    "cve": [
      {
        "cveNumber": "CVE-2018-8567"
      },
      {
        "cveNumber": "105784"
      }
    ]
  },
  "description": "Edge\u662f\u5fae\u8f6f\u4e3aWindows 10\u6253\u9020\u7684\u6d4f\u89c8\u5668\uff0c\u7279\u70b9\u662f\u5feb\u901f\u3001\u5b89\u5168\u3002\n\nMicrosoft Edge\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eMicrosoft Edge\u672a\u80fd\u6b63\u786e\u5b9e\u65bd\u8de8\u57df\u7b56\u7565\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ece\u4e00\u4e2a\u57df\u8bbf\u95ee\u4fe1\u606f\u5e76\u5c06\u5176\u6ce8\u5165\u53e6\u4e00\u4e2a\u57df\u3002",
  "discovererName": "dannywei of Tencent Security Xuanwu Lab",
  "formalWay": "\u5382\u5546\u5df2\u53d1\u5e03\u6f0f\u6d1e\u4fee\u590d\u7a0b\u5e8f\uff0c\u8bf7\u53ca\u65f6\u5173\u6ce8\u66f4\u65b0\uff1a\r\nhttps://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567",
  "isEvent": "\u901a\u7528\u8f6f\u786c\u4ef6\u6f0f\u6d1e",
  "number": "CNVD-2019-02493",
  "openTime": "2019-01-17",
  "patchDescription": "Edge\u662f\u5fae\u8f6f\u4e3aWindows 10\u6253\u9020\u7684\u6d4f\u89c8\u5668\uff0c\u7279\u70b9\u662f\u5feb\u901f\u3001\u5b89\u5168\u3002\r\n\r\nMicrosoft Edge\u5b58\u5728\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\u3002\u8be5\u6f0f\u6d1e\u6e90\u4e8eMicrosoft Edge\u672a\u80fd\u6b63\u786e\u5b9e\u65bd\u8de8\u57df\u7b56\u7565\uff0c\u653b\u51fb\u8005\u53ef\u5229\u7528\u8be5\u6f0f\u6d1e\u4ece\u4e00\u4e2a\u57df\u8bbf\u95ee\u4fe1\u606f\u5e76\u5c06\u5176\u6ce8\u5165\u53e6\u4e00\u4e2a\u57df\u3002\u76ee\u524d\uff0c\u4f9b\u5e94\u5546\u53d1\u5e03\u4e86\u5b89\u5168\u516c\u544a\u53ca\u76f8\u5173\u8865\u4e01\u4fe1\u606f\uff0c\u4fee\u590d\u4e86\u6b64\u6f0f\u6d1e\u3002",
  "patchName": "Microsoft Edge\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2019-02493\uff09\u7684\u8865\u4e01",
  "products": {
    "product": "Microsoft Edge \u65e0"
  },
  "referenceLink": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567\r\nhttps://www.securityfocus.com/bid/105784",
  "serverity": "\u4e2d",
  "submitTime": "2018-11-14",
  "title": "Microsoft Edge\u6743\u9650\u63d0\u5347\u6f0f\u6d1e\uff08CNVD-2019-02493\uff09"
}

CVE-2018-8567 (GCVE-0-2018-8567)

Vulnerability from cvelistv5

Published

2018-11-14 01:00

Modified

2024-08-05 07:02

Severity ?

CWE

Elevation of Privilege

Summary

An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka "Microsoft Edge Elevation of Privilege Vulnerability." This affects Microsoft Edge.

References

▼	URL	Tags
	http://www.securityfocus.com/bid/105784	vdb-entry, x_refsource_BID
	http://www.securitytracker.com/id/1042107	vdb-entry, x_refsource_SECTRACK
	https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567	x_refsource_CONFIRM

Impacted products

	Vendor	Product	Version
	Microsoft	Microsoft Edge	Version: Windows 10 Version 1709 for 32-bit Systems Version: Windows 10 Version 1709 for ARM64-based Systems Version: Windows 10 Version 1709 for x64-based Systems Version: Windows 10 Version 1803 for 32-bit Systems Version: Windows 10 Version 1803 for ARM64-based Systems Version: Windows 10 Version 1803 for x64-based Systems Version: Windows 10 Version 1809 for 32-bit Systems Version: Windows 10 Version 1809 for ARM64-based Systems Version: Windows 10 Version 1809 for x64-based Systems Version: Windows Server 2019

Show details on NVD website

JSON

To clipboard

{
  "containers": {
    "adp": [
      {
        "providerMetadata": {
          "dateUpdated": "2024-08-05T07:02:25.974Z",
          "orgId": "af854a3a-2127-422b-91ae-364da2661108",
          "shortName": "CVE"
        },
        "references": [
          {
            "name": "105784",
            "tags": [
              "vdb-entry",
              "x_refsource_BID",
              "x_transferred"
            ],
            "url": "http://www.securityfocus.com/bid/105784"
          },
          {
            "name": "1042107",
            "tags": [
              "vdb-entry",
              "x_refsource_SECTRACK",
              "x_transferred"
            ],
            "url": "http://www.securitytracker.com/id/1042107"
          },
          {
            "tags": [
              "x_refsource_CONFIRM",
              "x_transferred"
            ],
            "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567"
          }
        ],
        "title": "CVE Program Container"
      }
    ],
    "cna": {
      "affected": [
        {
          "product": "Microsoft Edge",
          "vendor": "Microsoft",
          "versions": [
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for ARM64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1709 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for ARM64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1803 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for 32-bit Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for ARM64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows 10 Version 1809 for x64-based Systems"
            },
            {
              "status": "affected",
              "version": "Windows Server 2019"
            }
          ]
        }
      ],
      "datePublic": "2018-11-13T00:00:00",
      "descriptions": [
        {
          "lang": "en",
          "value": "An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka \"Microsoft Edge Elevation of Privilege Vulnerability.\" This affects Microsoft Edge."
        }
      ],
      "problemTypes": [
        {
          "descriptions": [
            {
              "description": "Elevation of Privilege",
              "lang": "en",
              "type": "text"
            }
          ]
        }
      ],
      "providerMetadata": {
        "dateUpdated": "2018-11-14T10:57:02",
        "orgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
        "shortName": "microsoft"
      },
      "references": [
        {
          "name": "105784",
          "tags": [
            "vdb-entry",
            "x_refsource_BID"
          ],
          "url": "http://www.securityfocus.com/bid/105784"
        },
        {
          "name": "1042107",
          "tags": [
            "vdb-entry",
            "x_refsource_SECTRACK"
          ],
          "url": "http://www.securitytracker.com/id/1042107"
        },
        {
          "tags": [
            "x_refsource_CONFIRM"
          ],
          "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567"
        }
      ],
      "x_legacyV4Record": {
        "CVE_data_meta": {
          "ASSIGNER": "secure@microsoft.com",
          "ID": "CVE-2018-8567",
          "STATE": "PUBLIC"
        },
        "affects": {
          "vendor": {
            "vendor_data": [
              {
                "product": {
                  "product_data": [
                    {
                      "product_name": "Microsoft Edge",
                      "version": {
                        "version_data": [
                          {
                            "version_value": "Windows 10 Version 1709 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for ARM64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1709 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for ARM64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1803 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for 32-bit Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for ARM64-based Systems"
                          },
                          {
                            "version_value": "Windows 10 Version 1809 for x64-based Systems"
                          },
                          {
                            "version_value": "Windows Server 2019"
                          }
                        ]
                      }
                    }
                  ]
                },
                "vendor_name": "Microsoft"
              }
            ]
          }
        },
        "data_format": "MITRE",
        "data_type": "CVE",
        "data_version": "4.0",
        "description": {
          "description_data": [
            {
              "lang": "eng",
              "value": "An elevation of privilege vulnerability exists when Microsoft Edge does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain, aka \"Microsoft Edge Elevation of Privilege Vulnerability.\" This affects Microsoft Edge."
            }
          ]
        },
        "problemtype": {
          "problemtype_data": [
            {
              "description": [
                {
                  "lang": "eng",
                  "value": "Elevation of Privilege"
                }
              ]
            }
          ]
        },
        "references": {
          "reference_data": [
            {
              "name": "105784",
              "refsource": "BID",
              "url": "http://www.securityfocus.com/bid/105784"
            },
            {
              "name": "1042107",
              "refsource": "SECTRACK",
              "url": "http://www.securitytracker.com/id/1042107"
            },
            {
              "name": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567",
              "refsource": "CONFIRM",
              "url": "https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8567"
            }
          ]
        }
      }
    }
  },
  "cveMetadata": {
    "assignerOrgId": "f38d906d-7342-40ea-92c1-6c4a2c6478c8",
    "assignerShortName": "microsoft",
    "cveId": "CVE-2018-8567",
    "datePublished": "2018-11-14T01:00:00",
    "dateReserved": "2018-03-14T00:00:00",
    "dateUpdated": "2024-08-05T07:02:25.974Z",
    "state": "PUBLISHED"
  },
  "dataType": "CVE_RECORD",
  "dataVersion": "5.1"
}

Sightings

Author	Source	Type	Date

Nomenclature

Seen: The vulnerability was mentioned, discussed, or seen somewhere by the user.
Confirmed: The vulnerability is confirmed from an analyst perspective.
Exploited: This vulnerability was exploited and seen by the user reporting the sighting.
Patched: This vulnerability was successfully patched by the user reporting the sighting.
Not exploited: This vulnerability was not exploited or seen by the user reporting the sighting.
Not confirmed: The user expresses doubt about the veracity of the vulnerability.
Not patched: This vulnerability was not successfully patched by the user reporting the sighting.

Action not permitted