8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
40.8%
The version of Microsoft Edge installed on the remote Windows host is prior to 124.0.2478.51. It is, therefore, affected by multiple vulnerabilities as referenced in the April 18, 2024 advisory.
Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability (CVE-2024-29986)
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVE-2024-29987)
Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVE-2024-29991)
Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3832)
Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3833)
Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3834)
Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-3837)
Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security severity: Medium) (CVE-2024-3838)
Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain potentially sensitive information from process memory via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-3839)
Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-3840)
Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security severity: Medium) (CVE-2024-3841)
Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium) (CVE-2024-3843)
Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low) (CVE-2024-3844)
Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass mixed content policy via a crafted HTML page. (Chromium security severity: Low) (CVE-2024-3845)
Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.
(Chromium security severity: Low) (CVE-2024-3846)
Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to bypass content security policy via a crafted HTML page. (Chromium security severity: Low) (CVE-2024-3847)
Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3914)
Note that Nessus has not tested for these issues but has instead relied only on the application’s self-reported version number.
#%NASL_MIN_LEVEL 80900
##
# (C) Tenable, Inc.
##
include('compat.inc');
if (description)
{
script_id(193518);
script_version("1.5");
script_set_attribute(attribute:"plugin_modification_date", value:"2024/05/17");
script_cve_id(
"CVE-2024-3832",
"CVE-2024-3833",
"CVE-2024-3834",
"CVE-2024-3837",
"CVE-2024-3838",
"CVE-2024-3839",
"CVE-2024-3840",
"CVE-2024-3841",
"CVE-2024-3843",
"CVE-2024-3844",
"CVE-2024-3845",
"CVE-2024-3846",
"CVE-2024-3847",
"CVE-2024-3914",
"CVE-2024-29986",
"CVE-2024-29987",
"CVE-2024-29991"
);
script_xref(name:"IAVA", value:"2024-A-0253-S");
script_name(english:"Microsoft Edge (Chromium) < 124.0.2478.51 Multiple Vulnerabilities");
script_set_attribute(attribute:"synopsis", value:
"The remote host has an web browser installed that is affected by multiple vulnerabilities.");
script_set_attribute(attribute:"description", value:
"The version of Microsoft Edge installed on the remote Windows host is prior to 124.0.2478.51. It is, therefore, affected
by multiple vulnerabilities as referenced in the April 18, 2024 advisory.
- Microsoft Edge for Android (Chromium-based) Information Disclosure Vulnerability (CVE-2024-29986)
- Microsoft Edge (Chromium-based) Information Disclosure Vulnerability (CVE-2024-29987)
- Microsoft Edge (Chromium-based) Security Feature Bypass Vulnerability (CVE-2024-29991)
- Object corruption in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially
exploit object corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3832)
- Object corruption in WebAssembly in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to
potentially exploit object corruption via a crafted HTML page. (Chromium security severity: High)
(CVE-2024-3833)
- Use after free in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to
potentially exploit heap corruption via a crafted HTML page. (Chromium security severity: High)
(CVE-2024-3834)
- Use after free in QUIC in Google Chrome prior to 124.0.6367.60 allowed a remote attacker who had
compromised the renderer process to potentially exploit heap corruption via a crafted HTML page. (Chromium
security severity: Medium) (CVE-2024-3837)
- Inappropriate implementation in Autofill in Google Chrome prior to 124.0.6367.60 allowed an attacker who
convinced a user to install a malicious app to perform UI spoofing via a crafted app. (Chromium security
severity: Medium) (CVE-2024-3838)
- Out of bounds read in Fonts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to obtain
potentially sensitive information from process memory via a crafted HTML page. (Chromium security
severity: Medium) (CVE-2024-3839)
- Insufficient policy enforcement in Site Isolation in Google Chrome prior to 124.0.6367.60 allowed a remote
attacker to bypass navigation restrictions via a crafted HTML page. (Chromium security severity: Medium)
(CVE-2024-3840)
- Insufficient data validation in Browser Switcher in Google Chrome prior to 124.0.6367.60 allowed a remote
attacker to inject scripts or HTML into a privileged page via a malicious file. (Chromium security
severity: Medium) (CVE-2024-3841)
- Insufficient data validation in Downloads in Google Chrome prior to 124.0.6367.60 allowed a remote
attacker to perform UI spoofing via a crafted HTML page. (Chromium security severity: Medium)
(CVE-2024-3843)
- Inappropriate implementation in Extensions in Google Chrome prior to 124.0.6367.60 allowed a remote
attacker to perform UI spoofing via a crafted Chrome Extension. (Chromium security severity: Low)
(CVE-2024-3844)
- Inappropriate implementation in Networks in Google Chrome prior to 124.0.6367.60 allowed a remote attacker
to bypass mixed content policy via a crafted HTML page. (Chromium security severity: Low) (CVE-2024-3845)
- Inappropriate implementation in Prompts in Google Chrome prior to 124.0.6367.60 allowed a remote attacker
who convinced a user to engage in specific UI gestures to perform UI spoofing via a crafted HTML page.
(Chromium security severity: Low) (CVE-2024-3846)
- Insufficient policy enforcement in WebUI in Google Chrome prior to 124.0.6367.60 allowed a remote attacker
to bypass content security policy via a crafted HTML page. (Chromium security severity: Low)
(CVE-2024-3847)
- Use after free in V8 in Google Chrome prior to 124.0.6367.60 allowed a remote attacker to potentially
exploit heap corruption via a crafted HTML page. (Chromium security severity: High) (CVE-2024-3914)
Note that Nessus has not tested for these issues but has instead relied only on the application's self-reported version
number.");
# https://docs.microsoft.com/en-us/DeployEdge/microsoft-edge-relnotes-security#april-18-2024
script_set_attribute(attribute:"see_also", value:"http://www.nessus.org/u?9bfb7f33");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3832");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3833");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3834");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3837");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3838");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3839");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3840");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3841");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3843");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3844");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3845");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3846");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3847");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3914");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29986");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29987");
script_set_attribute(attribute:"see_also", value:"https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29991");
script_set_attribute(attribute:"solution", value:
"Upgrade to Microsoft Edge version 124.0.2478.51 or later.");
script_set_cvss_base_vector("CVSS2#AV:N/AC:L/Au:N/C:C/I:C/A:C");
script_set_cvss_temporal_vector("CVSS2#E:U/RL:OF/RC:C");
script_set_cvss3_base_vector("CVSS:3.0/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H");
script_set_cvss3_temporal_vector("CVSS:3.0/E:U/RL:O/RC:C");
script_set_attribute(attribute:"cvss_score_source", value:"CVE-2024-3837");
script_set_attribute(attribute:"exploitability_ease", value:"No known exploits are available");
script_set_attribute(attribute:"exploit_available", value:"false");
script_set_attribute(attribute:"vuln_publication_date", value:"2024/04/16");
script_set_attribute(attribute:"patch_publication_date", value:"2024/04/18");
script_set_attribute(attribute:"plugin_publication_date", value:"2024/04/18");
script_set_attribute(attribute:"plugin_type", value:"local");
script_set_attribute(attribute:"cpe", value:"cpe:/a:microsoft:edge");
script_set_attribute(attribute:"generated_plugin", value:"current");
script_set_attribute(attribute:"stig_severity", value:"I");
script_end_attributes();
script_category(ACT_GATHER_INFO);
script_family(english:"Windows");
script_copyright(english:"This script is Copyright (C) 2024 and is owned by Tenable, Inc. or an Affiliate thereof.");
script_dependencies("microsoft_edge_chromium_installed.nbin", "smb_hotfixes.nasl");
script_require_keys("installed_sw/Microsoft Edge (Chromium)", "SMB/Registry/Enumerated");
exit(0);
}
include('vcf.inc');
include('smb_hotfixes.inc');
get_kb_item_or_exit('SMB/Registry/Enumerated');
if (hotfix_check_sp_range(win10:'0') <= 0)
audit(AUDIT_OS_SP_NOT_VULN);
var app_info = vcf::get_app_info(app:'Microsoft Edge (Chromium)', win_local:TRUE);
var extended = FALSE;
if (app_info['Channel'] == 'extended') extended = TRUE;
var constraints;
if (!extended) {
constraints = [
{ 'fixed_version' : '124.0.2478.51' }
];
} else {
audit(AUDIT_INST_VER_NOT_VULN, 'Microsoft Edge (Chromium)');
};
vcf::check_version_and_report(
app_info:app_info,
constraints:constraints,
severity:SECURITY_HOLE
);
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29986
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29987
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-29991
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3832
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3833
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3834
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3837
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3838
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3839
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3840
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3841
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3843
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3844
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3845
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3846
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3847
cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-3914
www.nessus.org/u?9bfb7f33
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29986
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29987
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-29991
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3832
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3833
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3834
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3837
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3838
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3839
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3840
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3841
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3843
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3844
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3845
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3846
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3847
msrc.microsoft.com/update-guide/vulnerability/CVE-2024-3914
8.8 High
CVSS3
Attack Vector
NETWORK
Attack Complexity
LOW
Privileges Required
NONE
User Interaction
REQUIRED
Scope
UNCHANGED
Confidentiality Impact
HIGH
Integrity Impact
HIGH
Availability Impact
HIGH
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H
6.7 Medium
AI Score
Confidence
High
0.001 Low
EPSS
Percentile
40.8%