CVE-2023-33145
Published: 14 June 2023
Summary
CVE-2023-33145 is a medium-severity an unspecified weakness vulnerability in Microsoft Edge Chromium. Its CVSS base score is 6.5 (Medium).
Operationally, ranked in the top 8.1% of CVEs by exploit likelihood; it is not currently listed in the CISA KEV catalog.
Deeper analysis
Microsoft Edge (Chromium-based) contains an information disclosure vulnerability tracked as CVE-2023-33145. The flaw received a CVSS 3.1 score of 6.5 with a vector indicating network attack vector, low complexity, no required privileges, and required user interaction, resulting in high impact to confidentiality while leaving integrity and availability unaffected.
An unauthenticated remote attacker can exploit the issue by convincing a user to visit a specially crafted web page in Microsoft Edge. Successful exploitation discloses sensitive information from the browser process without further user action beyond page visitation.
Microsoft has published remediation guidance in its Security Response Center update guide for CVE-2023-33145, and Gentoo Linux has issued GLSA-202402-05 addressing the vulnerability in affected packages. The associated EPSS score has remained flat at 0.0744 with no material increase since disclosure.
EU & UK References
- 🇪🇺 ENISA EUVD: EUVD-2023-37330
Vulnerability details
Microsoft Edge (Chromium-based) Information Disclosure Vulnerability
- CWE(s)
Related Threats
No named actor attribution yet. ATT&CK technique mapping in progress for this CVE.
Affected Assets
Mitigating Controls
No mitigating controls mapped yet. The per-CVE control annotator has not reached this CVE.