8.8high
CVE-2017-8625in critical feed
Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code In…
Published 9 y ago · modified 4 mo ago · JSON
CVSS
8.8
v3.0 · NVD
CISA KEV
No
not known exploited
EPSS
15.4%
percentile 97%
Public exploits
0
none known
Summary
Internet Explorer in Windows 10 Gold, 1511, 1607, 1703, and Windows Server 2016 allows an attacker to bypass Device Guard User Mode Code Integrity (UMCI) policies due to Internet Explorer failing to validate UMCI policies, aka "Internet Explorer Security Feature Bypass Vulnerability".
Exploit prediction (EPSS)
15.38% probability of exploitation in the next 30 days, higher than 97% of all scored CVEs.
CVSS scores
| Assigned by | Version | Score | Vector |
|---|---|---|---|
| NVD | 3.0 | 8.8 | CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H |
| NVD | 2.0 | 6.8 | AV:N/AC:M/Au:N/C:P/I:P/A:P |
Affected products
- Microsoft Corporation Internet Explorer
Classification
- Weakness
- CWE-276 Incorrect Default Permissions
References
- portal.msrc.microsoft.com /en-US/security-guidance/advisory/CVE-2017-8625 · x_transferred
- posts.specterops.io /umci-vs-internet-explorer-exploring-cve-2017-8625-3946536c6442 · x_transferred
- securityfocus.com /bid/100063 · vdb-entry, x_transferred
- securitytracker.com /id/1039112 · vdb-entry, x_transferred
- oddvar.moe /2017/08/13/bypassing-device-guard-umci-using-chm-cve-2017-8625/ · x_transferred
Sources
- CVE List: CVE-2017-8625
- NVD: CVE-2017-8625
vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.