CVE-2017-0231 : A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filte

A spoofing vulnerability exists when Microsoft browsers render SmartScreen Filter, aka "Microsoft Browser Spoofing Vulnerability."

Published 2017-05-12 14:29:03

Updated 2017-07-08 01:29:04

View at NVD, CVE.org

Vulnerability category: Input validation

Products affected by CVE-2017-0231

Microsoft » Internet Explorer » Version: 11
cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*
Matching versions
Microsoft » Edge
cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*
Matching versions

EPSS FAQ

0.60%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 76 %

Percentile, the proportion of vulnerabilities that are scored at or less

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
4.3	MEDIUM	AV:N/AC:M/Au:N/C:N/I:P/A:N	8.6	2.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: None Integrity Impact: Partial Availability Impact: None
4.3	MEDIUM	CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:N/I:L/A:N	2.8	1.4	NIST
Attack Vector: Network Attack Complexity: Low Privileges Required: None User Interaction: Required Scope: Unchanged Confidentiality: None Integrity: Low Availability: None

CWE-20 Improper Input Validation

The product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Assigned by: nvd@nist.gov (Primary)

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-0231

CVE-2017-0231 | Microsoft Browser Spoofing Vulnerability
Patch;Vendor Advisory
http://www.securitytracker.com/id/1038455

Microsoft Edge HTML Parsing Flaw Lets Remote Users Redirect the Target User's Browser to an Arbitrary Site to Conduct Spoofing Attacks - SecurityTracker
http://www.securityfocus.com/bid/98173

Microsoft Internet Explorer and Edge CVE-2017-0231 Spoofing Vulnerability
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1038456

Microsoft Internet Explorer HTML Parsing Flaw Lets Remote Users Redirect the Target User's Browser to an Arbitrary Site to Conduct Spoofing Attacks - SecurityTracker

Jump to