CVE-2016-3388

Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified vectors, aka "Microsoft Browser Elevation of Privilege Vulnerability," a different vulnerability than CVE-2016-3387.

CVSS v3 5.3 MEDIUM
CVSS v2.0 2.6 LOW

5.3^/10

CVSS v3 : MEDIUM

Vector : AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N

Exploitability : 1.6 / Impact : 3.6

Attack Vector NETWORK

Attack Complexity HIGH

Privileges Required NONE

User Interaction REQUIRED

Confidentiality Impact NONE

Integrity Impact HIGH

Availability Impact NONE

Scope UNCHANGED

2.6^/10

CVSS v2.0 : LOW

Vector : AV:N/AC:H/Au:N/C:N/I:P/A:N

Exploitability : 4.9 / Impact : 2.9

Access Vector NETWORK

Access Complexity HIGH

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/93382
http://www.securitytracker.com/id/1036992
http://www.securitytracker.com/id/1036993
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119
https://www.exploit-db.com/exploits/40606/
http://www.securityfocus.com/bid/93382
http://www.securitytracker.com/id/1036992
http://www.securitytracker.com/id/1036993
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119
https://www.exploit-db.com/exploits/40606/

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:edge::::::::
	cpe:2.3:a:microsoft:internet_explorer:10:::::::*
	cpe:2.3:a:microsoft:internet_explorer:11:::::::*

History

No history.

Information

Published : 2016-10-14 02:59

Updated : 2025-04-12 10:46

NVD link : CVE-2016-3388

Mitre link : CVE-2016-3388

CVE.ORG link : CVE-2016-3388

JSON object : View

Products Affected

microsoft

internet_explorer
edge

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2016-3388", "cveTags": [], "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 2.6, "accessVector": "NETWORK", "vectorString": "AV:N/AC:H/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "HIGH", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "LOW", "obtainAllPrivilege": false, "exploitabilityScore": 4.9, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}], "cvssMetricV30": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"scope": "UNCHANGED", "version": "3.0", "baseScore": 5.3, "attackVector": "NETWORK", "baseSeverity": "MEDIUM", "vectorString": "CVSS:3.0/AV:N/AC:H/PR:N/UI:R/S:U/C:N/I:H/A:N", "integrityImpact": "HIGH", "userInteraction": "REQUIRED", "attackComplexity": "HIGH", "availabilityImpact": "NONE", "privilegesRequired": "NONE", "confidentialityImpact": "NONE"}, "impactScore": 3.6, "exploitabilityScore": 1.6}]}, "published": "2016-10-14T02:59:24.930", "references": [{"url": "http://www.securityfocus.com/bid/93382", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1036992", "source": "secure@microsoft.com"}, {"url": "http://www.securitytracker.com/id/1036993", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118", "source": "secure@microsoft.com"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119", "source": "secure@microsoft.com"}, {"url": "https://www.exploit-db.com/exploits/40606/", "source": "secure@microsoft.com"}, {"url": "http://www.securityfocus.com/bid/93382", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1036992", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "http://www.securitytracker.com/id/1036993", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-118", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-119", "source": "af854a3a-2127-422b-91ae-364da2661108"}, {"url": "https://www.exploit-db.com/exploits/40606/", "source": "af854a3a-2127-422b-91ae-364da2661108"}], "vulnStatus": "Deferred", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Internet Explorer 10 and 11 and Microsoft Edge do not properly restrict access to private namespaces, which allows remote attackers to gain privileges via unspecified vectors, aka \"Microsoft Browser Elevation of Privilege Vulnerability,\" a different vulnerability than CVE-2016-3387."}, {"lang": "es", "value": "Microsoft Internet Explorer 10 y 11 y Microsoft Edge no restringe adecuadamente el acceso a espacios de nombres privados, lo que permite a atacantes remotos obtener privilegios a trav\u00e9s de vectores no especificados, vulnerabilidad tambi\u00e9n conocida como \"Microsoft Browser Elevation of Privilege Vulnerability\", una vulnerabilidad diferente a CVE-2016-3387."}], "lastModified": "2025-04-12T10:46:40.837", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:edge:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "8BD5B232-95EA-4F8E-8C7D-7976877AD243"}, {"criteria": "cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "D5808661-A082-4CBE-808C-B253972487B4"}, {"criteria": "cpe:2.3:a:microsoft:internet_explorer:11:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "15BAAA8C-7AF1-46CE-9FFB-3A498508A1BF"}], "operator": "OR"}]}], "sourceIdentifier": "secure@microsoft.com"}