CVE-2018-8289: Infoleak

Published Jul 11, 2018

Updated

An information disclosure vulnerability exists when Microsoft Edge improperly handles objects in memory, aka "Microsoft Edge Information Disclosure Vulnerability." This affects Microsoft Edge. This CVE ID is unique from CVE-2018-8297, CVE-2018-8324, CVE-2018-8325.

Affected Software

4 affected components

Microsoft Edge

Microsoft Windows 10=1803

All of the following

Microsoft Edge

Microsoft Windows 10=1803

Remediation

Patch Available

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2018-8289

Event History

Jul 11, 2018

CVE Published

via MITRE·12:00 AM

Data Sourced

via MITRE·12:00 AM

DescriptionWeakness

Data Sourced

via NVD·12:29 AM

RemedyDescriptionSeverityWeaknessAffected Software

Frequently Asked Questions

What does an attacker need to exploit this issue?

The CVSS vector indicates the attack can be delivered over the network without attacker privileges, but it requires user interaction. The impact is limited to disclosure of information; no integrity or availability impact is indicated.

What should organizations do to remediate the vulnerability?

Apply the available patch for Microsoft Edge. If patching cannot occur immediately, reducing exposure to untrusted web content can help limit the required user-interaction attack scenario.