CVE-2017-8498

MEDIUM

Microsoft Edge - Information Disclosure via JavaScript XML DOM Extension Detection

Title source: llm

Description

Microsoft Edge in Windows 10 1607 and 1703, and Windows Server 2016 allows an attacker to read data not intended to be disclosed when Edge allows JavaScript XML DOM objects to detect installed browser extensions, aka "Microsoft Edge Information Disclosure Vulnerability". This CVE ID is unique from CVE-2017-8504.

References (2)

Core 2

Core References

Third Party Advisory, VDB Entry vdb-entry x_refsource_bid

http://www.securityfocus.com/bid/98886

Patch, Vendor Advisory x_refsource_confirm

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8498

Scores

CVSS v3 4.3

EPSS 0.1224

EPSS Percentile 93.9%

Attack Vector NETWORK

CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:N/A:N

Details

CWE

CWE-200

Status published

Products (2)

microsoft/edge

Microsoft Corporation/Microsoft Edge Microsoft Windows 10 1607 and 1703, and Windows Server 2016.

Published Jun 15, 2017

Tracked Since Feb 18, 2026