Actively exploited in the wild
Microsoft Internet Explorer Messaging API Information Disclosure Vulnerability
Microsoft - Internet Explorer · Listed in the CISA KEV since 2022-05-24. This indicates confirmed attacks in production environments.
Required action: Apply updates per vendor instructions.
CVE-2016-3298
MediumCVSS 6.5KEVSummary
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2/R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site (Information Disclosure).
Risk Assessment
An attacker can remotely detect the presence of files on a victim's system, aiding reconnaissance and preparation of further attacks.
Recommendation
Apply Microsoft security updates for Internet Explorer and the Internet Messaging API on affected systems.
Other vulnerabilities in Microsoft Internet Explorer
See all- CVE-2017-8609High
A vulnerability in the JavaScript engine of Microsoft Internet Explorer allows an attacker to execute arbitrary code in the context of the current user. The issue occurs in Windows 10 and Windows Server 2016 when the engine improperly handles objects in memory.
- CVE-2016-7283High
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2016-3384High
Microsoft Internet Explorer versions 9 through 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2016-3353High
Microsoft Internet Explorer versions 9 through 11 mishandles .url files from the Internet zone, allowing remote attackers to bypass intended access restrictions via a crafted file.
- CVE-2016-3324High
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2016-3290High
Microsoft Internet Explorer 11 contains a vulnerability that allows remote attackers to execute arbitrary code via a crafted web page. This is a memory corruption vulnerability in the browser.
- CVE-2016-3288High
Microsoft Internet Explorer 11 contains a vulnerability that allows remote attackers to execute arbitrary code via a crafted web page, known as 'Internet Explorer Memory Corruption Vulnerability.'
- CVE-2016-3243High
Microsoft Internet Explorer 10 and 11 allows remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site.
- CVE-2016-3242High
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site, known as 'Internet Explorer Memory Corruption Vulnerability.'
- CVE-2016-3241High
Microsoft Internet Explorer versions 9 through 11 allow remote attackers to execute arbitrary code or cause a denial of service (memory corruption) via a crafted web site. This is a different vulnerability than CVE-2016-3240 and CVE-2016-3242.
Original NVD description (English source)
Microsoft Internet Explorer 9 through 11 and the Internet Messaging API in Windows Vista SP2, Windows Server 2008 SP2 and R2 SP1, and Windows 7 SP1 allow remote attackers to determine the existence of arbitrary files via a crafted web site, aka "Internet Explorer Information Disclosure Vulnerability."