CVE-2017-8592 Security feature bypass in Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016
Microsoft browsers allow a security feature bypass when improperly handling redirect requests, potentially exposing users to security risks.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2017-8592?
CVE-2017-8592 is a medium-severity vulnerability in Microsoft Edge, published on 11 Jul 2017. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Microsoft browsers on when Microsoft Windows 7 SP1, Windows Server 2008 R2 SP1, Windows 8.1, Windows RT 8.1, and Windows Server 2012 and R2, Windows 10 Gold, 1511, 1607, and 1703, and Windows Server 2016 allow a security feature bypass vulnerability when they improperly handle redirect requests, aka "Microsoft Browser Security Feature Bypass".
Weakness: CWE-200
Which versions are affected by CVE-2017-8592?
It affects 9 products.
Products include Microsoft Edge, Microsoft Internet Explorer, Microsoft Windows 10, Microsoft Windows 7, Microsoft Windows 8.1, Microsoft Windows Rt 8.1 and 3 more.
How do I fix CVE-2017-8592?
No fix has been published for CVE-2017-8592 yet. Limit exposure of the affected software until one is available.
Is CVE-2017-8592 being exploited?
There is no known exploitation of CVE-2017-8592 in the wild and no public exploit code.
Other vulnerabilities in Microsoft Edge
Sources
Also known as GHSA-j79g-9xqw-gjwm.