{
  "cveId": "CVE-2017-8498",
  "url": "https://patchblox.com/security/cve/CVE-2017-8498",
  "summary": "CVE-2017-8498 is fixed in 5 products on 1 platform, first by KB4022715, released June 13, 2017. It is not reported as exploited. Patch Radar priority: Routine.",
  "title": "Microsoft Edge Information Disclosure Vulnerability",
  "description": "\u003Cp\u003EAn information disclosure vulnerability exists in Microsoft Edge that allows JavaScript XML DOM objects to detect installed browser extensions.\u003C/p\u003E\n\u003Cp\u003ETo exploit the vulnerability, in a web-based attack scenario, an attacker could host a malicious website in an attempt to make a user visit it. However, an attacker would have no way to force a user to view the attacker-controlled content. Instead, an attacker would have to convince a user to take action. For example, an attacker could trick a user into clicking a link that takes the user to the attacker\u0027s site.\u003C/p\u003E\n\u003Cp\u003EAn attacker who successfully exploited the vulnerability could potentially read data not intended to be disclosed. Note that the vulnerability would not allow an attacker to either execute code or elevate a user\u2019s rights directly, but the vulnerability could be used to obtain information in an attempt to further compromise the affected system.\u003C/p\u003E\n\u003Cp\u003EThe security update addresses the vulnerability by restricting what information is returned to Microsoft Edge by affected JavaScript object methods.\u003C/p\u003E",
  "published": "2017-06-13T07:00:00Z",
  "severity": "Moderate",
  "cvss": 4.3,
  "epss": 0.0518,
  "epssPercentile": 0.92496,
  "priority": "Routine",
  "priorityTier": 4,
  "exploited": false,
  "vendorExploited": false,
  "disclosed": true,
  "exploitabilityAssessment": "Exploitation Less Likely",
  "vendorAdvisory": "https://msrc.microsoft.com/update-guide/vulnerability/CVE-2017-8498",
  "fixes": [
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for 32-bit Systems",
      "fixedVersion": "14393.1358",
      "fix": "KB4022715",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022715",
      "released": "2017-06-13T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1607 for x64-based Systems",
      "fixedVersion": "14393.1358",
      "fix": "KB4022715",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022715",
      "released": "2017-06-13T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for 32-bit Systems",
      "fixedVersion": "",
      "fix": "KB4022725",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022725",
      "released": "2017-06-13T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows 10 Version 1703 for x64-based Systems",
      "fixedVersion": "",
      "fix": "KB4022725",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022725",
      "released": "2017-06-13T00:00:00Z"
    },
    {
      "platform": "microsoft",
      "product": "Microsoft Edge (EdgeHTML-based) on Windows Server 2016",
      "fixedVersion": "14393.1358",
      "fix": "KB4022715",
      "url": "https://patchblox.com/security/fix/microsoft/kb4022715",
      "released": "2017-06-13T00:00:00Z"
    }
  ],
  "noFixYet": [],
  "dataAsOf": "2026-11-07T12:40:37Z"
}