Vulnerability Details : CVE-2016-3387
Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified vectors, aka "Microsoft Browser Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3388.
Vulnerability category: Gain privilege
Products affected by CVE-2016-3387
- cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
- cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*
- cpe:2.3:a:microsoft:edge:-:*:*:*:*:*:*:*
Exploit prediction scoring system (EPSS) score for CVE-2016-3387
21.55%
Probability of exploitation activity in the next 30 days
EPSS Score History
~ 97 %
Percentile, the proportion of vulnerabilities that are scored at or less
CVSS scores for CVE-2016-3387
| Base Score | Base Severity | CVSS Vector | Exploitability Score | Impact Score | Score Source | First Seen |
|---|---|---|---|---|---|---|
|
6.8
|
MEDIUM | AV:N/AC:M/Au:N/C:P/I:P/A:P |
8.6
|
6.4
|
NIST | |
|
7.5
|
HIGH | CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:H/I:H/A:H |
1.6
|
5.9
|
NIST |
CWE ids for CVE-2016-3387
-
Assigned by: nvd@nist.gov (Primary)
References for CVE-2016-3387
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119
Microsoft Security Bulletin MS16-119 - Critical | Microsoft Docs
-
http://www.securitytracker.com/id/1036993
Microsoft Edge Multiple Flaws Let Remote Users Obtain Potentially Sensitive Information, Bypass Security, Execute Arbitrary Code, and Gain Elevated Privileges - SecurityTracker
-
http://www.securitytracker.com/id/1036992
Microsoft Internet Explorer Multiple Flaws Let Remote Users Obtain Potentially Sensitive Information, Bypass Security, Execute Arbitrary Code, and Gain Elevated Privileges - SecurityTracker
-
http://www.securityfocus.com/bid/93381
Microsoft Internet Explorer and Edge CVE-2016-3387 Remote Privilege Escalation Vulnerability
-
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118
Microsoft Security Bulletin MS16-118 - Critical | Microsoft Docs
-
https://www.exploit-db.com/exploits/40607/
Microsoft Windows Edge/Internet Explorer - Isolated Private Namespace Insecure Boundary Descriptor Privilege Escalation (MS16-118)
Jump to