Input validation error in Microsoft Edge and Microsoft Internet Explorer - CVE-2019-1357
Published: October 8, 2019
Vulnerability identifier: #VU21633
CSH Severity: Medium
CVSS v4: 4.8 [CVSS:4.0/AV:N/AC:L/AT:N/PR:L/UI:A/VC:L/VI:L/VA:N/SC:N/SI:N/SA:N]
CVE-ID: CVE-2019-1357
CWE-ID: CWE-20
Exploitation vector: Remote access
Exploit availability:
No public exploit available
Vulnerability details
The vulnerability allows a remote attacker to spoofing attack.
The vulnerability exists due to insufficient validation of browser cookies. A remote attacker can send a specially crafted HTTP response and overwrite a secure cookie with an insecure one. This can be used to construct an attack chain against applications that rely on cookie security.
Affected software
Microsoft Edge
Microsoft Internet Explorer
Microsoft Internet Explorer
How to mitigate CVE-2019-1357
Install updates from vendor's website.