Actively exploited · Published Sep 14, 2016 · Assigned by microsoft
CVE-2016-3351
Medium 6.5 Exploited Ransomware
In plain English
A medium-severity security flaw in Internet Explorer and Edge from Microsoft. Attackers are actively exploiting it in the wild (listed by CISA on May 24, 2022). It has been used in ransomware campaigns. The chance it is exploited in the next 30 days is estimated at 26.5% (higher than 98% of all known vulnerabilities). Apply updates per vendor instructions.
Severity (CVSS 3.1)6.5Medium
Exploit odds (30 days)26.5%top 2.0% of all CVEs
Exploited in the wildYesCISA KEV since May 24, 2022
Attack toolingNoneno public tooling known
CISA guidance
Apply updates per vendor instructions.
Federal agencies must remediate by Jun 14, 2022.
Official description
Microsoft Internet Explorer 9 through 11 and Microsoft Edge allow remote attackers to obtain sensitive information via a crafted web site, aka "Microsoft Browser Information Disclosure Vulnerability."
Affected products (as reported)
References
- 1036789 vdb-entry, x_refsource_SECTRACK
- 92788 vdb-entry, x_refsource_BID
- https://www.brokenbrowser.com/detecting-apps-mimetype-malware/ x_refsource_MISC
- MS16-104 vendor-advisory, x_refsource_MS
- MS16-105 vendor-advisory, x_refsource_MS
- 1036788 vdb-entry, x_refsource_SECTRACK
- https://www.cisa.gov/known-exploited-vulnerabilities-catalog?field_cve=CVE-2016-3351 government-resource