# CVE-2017-0210: Internet Explorer Elevation of Privilege Vulnerability CVE-2017-0210 is fixed in 18 products on 1 platform, first by KB4015219, released April 11, 2017. It is being exploited: CISA added it to the Known Exploited Vulnerabilities catalog on May 24, 2022. Patch Radar priority: Patch now. - Web page: https://patchblox.com/security/cve/CVE-2017-0210 - Priority: Patch now - CVSS: 3.5 (Important) - EPSS: 0.2233 - CISA KEV: listed May 24, 2022, federal due date Jun 14, 2022 - Exploited (vendor report): yes - Publicly disclosed: yes - Vendor exploitability assessment: Exploitation Detected - Published: Apr 11, 2017 - Vendor advisory: https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-0210 ## Description

An elevation of privilege vulnerability exists when Internet Explorer does not properly enforce cross-domain policies, which could allow an attacker to access information from one domain and inject it into another domain.

In a web-based attack scenario, an attacker could host a website that is used to attempt to exploit the vulnerability. In addition, compromised websites and websites that accept or host user-provided content could contain specially crafted content that could exploit the vulnerability. In all cases, however, an attacker would have no way to force users to view the attacker-controlled content. Instead, an attacker would have to convince users to take action. For example, an attacker could trick users into clicking a link that takes them to the attacker's site. An attacker who successfully exploited this vulnerability could elevate privileges in affected versions of Internet Explorer.

The vulnerability by itself does not allow arbitrary code to be run. However, the vulnerability could be used in conjunction with another vulnerability (for example, a remote code execution vulnerability) that could take advantage of the elevated privileges when running arbitrary code. For example, an attacker could exploit another vulnerability to run arbitrary code through Internet Explorer, but due to the context in which processes are launched by Internet Explorer, the code might be restricted to run at a low integrity level (very limited permissions). However, an attacker could, in turn, exploit this vulnerability to cause the arbitrary code to run at a medium integrity level (permissions of the current user).

The update addresses the vulnerability by helping to ensure that cross-domain policies are properly enforced in Internet Explorer.

## Where it's fixed | Platform | Product | Fixed in | Fix | Released | |---|---|---|---|---| | Microsoft | Internet Explorer 10 on Windows Server 2012 | | [KB4014661](https://patchblox.com/security/data/fix/microsoft/kb4014661.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 10 on Windows Server 2012 | | [KB4015551](https://patchblox.com/security/data/fix/microsoft/kb4015551.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 Version 1511 for 32-bit Systems | 10586.873 | [KB4015219](https://patchblox.com/security/data/fix/microsoft/kb4015219.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 Version 1511 for x64-based Systems | 10586.873 | [KB4015219](https://patchblox.com/security/data/fix/microsoft/kb4015219.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 Version 1607 for 32-bit Systems | | [KB4015217](https://patchblox.com/security/data/fix/microsoft/kb4015217.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 Version 1607 for x64-based Systems | | [KB4015217](https://patchblox.com/security/data/fix/microsoft/kb4015217.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 Version 1703 for 32-bit Systems | 15063.138 | [KB4015583](https://patchblox.com/security/data/fix/microsoft/kb4015583.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 Version 1703 for x64-based Systems | 15063.138 | [KB4015583](https://patchblox.com/security/data/fix/microsoft/kb4015583.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 for 32-bit Systems | 10240.17354 | [KB4015221](https://patchblox.com/security/data/fix/microsoft/kb4015221.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 10 for x64-based Systems | 10240.17354 | [KB4015221](https://patchblox.com/security/data/fix/microsoft/kb4015221.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1 | | [KB4014661](https://patchblox.com/security/data/fix/microsoft/kb4014661.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 7 for 32-bit Systems Service Pack 1 | | [KB4015549](https://patchblox.com/security/data/fix/microsoft/kb4015549.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1 | | [KB4014661](https://patchblox.com/security/data/fix/microsoft/kb4014661.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 7 for x64-based Systems Service Pack 1 | | [KB4015549](https://patchblox.com/security/data/fix/microsoft/kb4015549.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 8.1 for 32-bit systems | | [KB4014661](https://patchblox.com/security/data/fix/microsoft/kb4014661.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 8.1 for 32-bit systems | | [KB4015550](https://patchblox.com/security/data/fix/microsoft/kb4015550.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 8.1 for x64-based systems | | [KB4014661](https://patchblox.com/security/data/fix/microsoft/kb4014661.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows 8.1 for x64-based systems | | [KB4015550](https://patchblox.com/security/data/fix/microsoft/kb4015550.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows RT 8.1 | | [KB4015550](https://patchblox.com/security/data/fix/microsoft/kb4015550.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 | | [KB4014661](https://patchblox.com/security/data/fix/microsoft/kb4014661.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows Server 2008 R2 for x64-based Systems Service Pack 1 | | [KB4015549](https://patchblox.com/security/data/fix/microsoft/kb4015549.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows Server 2012 R2 | | [KB4014661](https://patchblox.com/security/data/fix/microsoft/kb4014661.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows Server 2012 R2 | | [KB4015550](https://patchblox.com/security/data/fix/microsoft/kb4015550.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows Server 2016 | | [KB4015217](https://patchblox.com/security/data/fix/microsoft/kb4015217.md) | Apr 11, 2017 | | Microsoft | Internet Explorer 11 on Windows Server 2016 (Server Core installation) | | [KB4015217](https://patchblox.com/security/data/fix/microsoft/kb4015217.md) | Apr 11, 2017 | --- Data as of 2026-11-07T18:46:35Z UTC. Source: Patchblox Patch Radar (https://patchblox.com/security/patch-radar). Patchblox finds out-of-date software on Windows, macOS and Linux and updates it through release rings: https://patchblox.com/demo Free to use with attribution: show "Data: Patchblox Patch Radar" with a link to https://patchblox.com/security/patch-radar. Terms, including what needs a written agreement: https://patchblox.com/security/patch-radar/use-the-data Product names, logos and trademarks shown on Patch Radar belong to their respective owners. They are used only to identify the software each security fix applies to and to help readers find their platform. Their use does not imply any affiliation with, or endorsement by, those owners, and Patchblox is not affiliated with any of them.