CVE-2016-3321 : Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the f

Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure Vulnerability."

Published 2016-08-09 21:59:29

Updated 2018-10-12 22:12:30

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Exploit prediction scoring system (EPSS) score for CVE-2016-3321

Probability of exploitation activity in the next 30 days: 0.08%

Percentile, the proportion of vulnerabilities that are scored at or less: ~ 31 % EPSS Score History EPSS FAQ

Metasploit modules for CVE-2016-3321

Internet Explorer Iframe Sandbox File Name Disclosure Vulnerability

Disclosure Date: 2016-08-09

First seen: 2020-04-26

auxiliary/gather/ie_sandbox_findfiles

It was found that Internet Explorer allows the disclosure of local file names. This issue exists due to the fact that Internet Explorer behaves different for file:// URLs pointing to existing and non-existent files. When used in combination with HTML5 sandbox iframes

More information

CVSS scores for CVE-2016-3321

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source
1.9	LOW	AV:L/AC:M/Au:N/C:P/I:N/A:N	3.4	2.9	NIST
Access Vector: Local Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: None Availability Impact: None
2.5	LOW	CVSS:3.0/AV:L/AC:H/PR:L/UI:N/S:U/C:L/I:N/A:N	1.0	1.4	NIST
Attack Vector: Local Attack Complexity: High Privileges Required: Low User Interaction: None Scope: Unchanged Confidentiality: Low Integrity: None Availability: None

CWE ids for CVE-2016-3321

CWE-200 Exposure of Sensitive Information to an Unauthorized Actor

The product exposes sensitive information to an actor that is not explicitly authorized to have access to that information.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2016-3321

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2016/ms16-095

Microsoft Security Bulletin MS16-095 - Critical | Microsoft Docs

CVEs referencing this url
http://www.securityfocus.com/archive/1/539174/100/0/threaded

SecurityFocus
http://www.securityfocus.com/bid/92291

Microsoft Internet Explorer CVE-2016-3321 Local Information Disclosure Vulnerability
http://seclists.org/fulldisclosure/2016/Aug/44

Full Disclosure: Internet Explorer iframe sandbox local file name disclosure vulnerability
Mailing List;Third Party Advisory
https://www.securify.nl/advisory/SFY20160301/internet_explorer_iframe_sandbox_local_file_name_disclosure_vulnerability.html

Internet Explorer iframe sandbox local file name disclosure vulnerability - Security Advisories and Insights - Securify B.V.
Third Party Advisory;VDB Entry
http://www.securitytracker.com/id/1036562

Microsoft Internet Explorer Multiple Flaws Let Remote Users Obtain Potentially Sensitive Information and Execute Arbitrary Code - SecurityTracker

CVEs referencing this url

Products affected by CVE-2016-3321

Microsoft » Internet Explorer » Version: 10
cpe:2.3:a:microsoft:internet_explorer:10:*:*:*:*:*:*:*
Matching versions
Microsoft » Internet Explorer » Version: 11
cpe:2.3:a:microsoft:internet_explorer:11:-:*:*:*:*:*:*
Matching versions