CVE-2023-38187: Microsoft Edge (Chromium-based) Elevation of Privilege Vulnerability
CVE-2023-38187 is an edge - chromium vulnerability in Microsoft Edge (Chromium-based), rated Moderate by Microsoft, with a CVSS 3.1 base score of 6.5 (Medium). An attacker can exploit it remotely over the network, without any privileges and without user interaction. Microsoft has not reported exploitation in the wild and rates exploitation as less likely. The EPSS model estimates a 0.77% probability of exploitation activity in the next 30 days, higher than 56% of all scored vulnerabilities. Microsoft released the fix on 21 July 2023 in the July 2023 Patch Tuesday. It affects 1 product in 1 product family (Browser).
Key facts
- CVE ID
- CVE-2023-38187
- Severity
- Medium CVSS 6.5
- Microsoft severity
- Moderate
- Impact
- Edge - Chromium
- Exploited in the wild
- No
- Publicly disclosed
- No
- Exploitation likelihood
- Less Likely
- Weakness
- CWE-269
- EPSS
- 0.77% (percentile 56%)
- CISA KEV
- Not listed
- Released
- Last updated
- Patch Tuesday
- July 2023 Patch Tuesday
- Product families
- Browser
CVSS score and vector
Microsoft scores CVE-2023-38187 at 6.5 (temporal 5.7) using CVSS 3.1. Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:H/I:L/A:N/E:U/RL:O/RC:C
| Metric | Value |
|---|---|
| Attack vector | Network |
| Attack complexity | High |
| Privileges required | None |
| User interaction | None |
| Scope | Unchanged |
| Confidentiality impact | High |
| Integrity impact | Low |
| Availability impact | None |
| Exploit code maturity | Unproven |
| Remediation level | Official fix |
| Report confidence | Confirmed |
Frequently asked questions (Microsoft)
What is the version information for this release?
Microsoft Edge Channel
Microsoft Edge Version
Based on Chromium Version
Date Released
Stable
115.0.1901.183
115.0.5790.98/99
7/21/2023
Extended Stable
114.0.1901.183
114.0.5735.243
7/21/2023
According to the CVSS metric, the attack complexity is high (AC:H). What does that mean for this vulnerability?
Successful exploitation of this vulnerability requires an attacker to take additional actions prior to exploitation to prepare the target environment.
According to the CVSS metric, successful exploitation of this vulnerability could lead to some loss of integrity (I:L)? What does that mean for this vulnerability?
The attacker is only able to modify limited content of the affected API.
According to the CVSS metric, successful exploitation of this vulnerability could lead to no loss of availability (A:N)? What does that mean for this vulnerability?
An attacker cannot impact the availability of the browser.
Affected products (1)
Browser
| Product | Security update | Type | Fixed build | Restart |
|---|---|---|---|---|
| Microsoft Edge (Chromium-based) | Release Notes | Security Update | 115.0.1901.183 | No |
NIST NVD data
- NVD status
- Modified
- NVD CVSS
- 6.5 (MEDIUM)
- NVD weakness
- CWE-269
- Published to NVD
- NVD last modified
Affected configurations (CPE)
| Product | Vulnerable versions |
|---|---|
| edge chromium | before 115.0.1901.183 |
References
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38187 (Patch, Vendor Advisory)
- https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-38187 (Patch, Vendor Advisory)
Acknowledgments
Revision history
| Version | Date | Description |
|---|---|---|
| 1.0 | Information published. |