CVE-2017-8671

EPSS 69.3%

Vexday Risk Score

35Attention

SSVC decision (CISA)

Attend

PoC available → attend closely

Exploit maturity

Proof of concept

Public proof of concept exists, but not yet automated.

CVSS —EPSS 69.3%KEV nãoPoC públicaNuclei —Metasploit —Patch —

Lifecycle

08 Aug 2017Published on NVD

17 Aug 2017Public PoC

Weaponization speed

8 daysto first PoC

Recommendation: Plan a near-term fix — a public PoC already exists.

Microsoft Edge in Microsoft Windows 10 1511, 1607, 1703, and Windows Server 2016 allows an attacker to execute arbitrary code in the context of the current user due to the way that Microsoft browser JavaScript engines render content when handling objects in memory, aka "Scripting Engine Memory Corruption Vulnerability". This CVE ID is unique from CVE-2017-8634, CVE-2017-8635, CVE-2017-8636, CVE-2017-8638, CVE-2017-8639, CVE-2017-8640, CVE-2017-8641, CVE-2017-8645, CVE-2017-8646, CVE-2017-8647, CVE-2017-8655, CVE-2017-8656, CVE-2017-8657, CVE-2017-8670, CVE-2017-8672, and CVE-2017-8674.

Affected products

n/a · n/a

public PoCs found — 2

cve_referencewww.exploit-db.com/exploits/42475/unverified exploitdbwww.exploit-db.com/exploits/42475unverified

⚠ Public resources, to assess the exposure of systems you control or are authorized to test. Test only with authorization.

References

https://portal.msrc.microsoft.com/en-US/security-guidance/advisory/CVE-2017-8671 https://www.exploit-db.com/exploits/42475/http://www.securityfocus.com/bid/100071 http://www.securitytracker.com/id/1039095