#VU5972 Cross-site scripting in Microsoft Internet Explorer - CVE-2017-0154

Vulnerability identifier: #VU5972

Vulnerability risk: Low

CVSSv4.0: 2 [CVSS:4.0/AV:N/AC:L/AT:N/PR:N/UI:A/VC:N/VI:N/VA:N/SC:L/SI:L/SA:N/E:P/U:Clear]

CVE-ID: CVE-2017-0154

CWE-ID: CWE-79

Exploitation vector: Network

Exploit availability: No

Vulnerable software:
Microsoft Internet Explorer
Client/Desktop applications / Web browsers

Vendor: Microsoft

Description

The disclosed vulnerability allows a remote attacker to perform cross-site scripting (XSS) attacks.

The vulnerability exists due to improper enforcement of cross-domain policies in Internet Explorer. A remote attacker can trick the victim to visit a specially crafted web site and access information from one domain and inject it into another domain.

Successful exploitation of this vulnerability may allow a remote attacker to steal potentially sensitive information, change appearance of the web page, perform phishing and drive-by-download attacks.

Mitigation

Install updates from vendor's website.

Vulnerable software versions

Microsoft Internet Explorer: 11

---

External links
https://technet.microsoft.com/en-us/library/security/MS17-006

---

Q & A

Can this vulnerability be exploited remotely?

Yes. This vulnerability can be exploited by a remote non-authenticated attacker via the Internet.

Is there known malware, which exploits this vulnerability?

No. We are not aware of malware exploiting this vulnerability. However, proof of concept for this vulnerability is available.