Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.
References
Configurations
Configuration 1 (hide)
|
History
21 Nov 2024, 01:28
Type | Values Removed | Values Added |
---|---|---|
References | () http://conference.hackinthebox.org/hitbsecconf2011ams/?page_id=1388 - | |
References | () http://ju12.tistory.com/attachment/cfile4.uf%40151FAB4C4DDC9E0002A6FE.ppt - | |
References | () http://news.cnet.com/8301-1009_3-20066419-83.html - | |
References | () http://www.eweek.com/c/a/Security/IE-Flaw-Lets-Attackers-Steal-Cookies-Access-User-Accounts-402503/ - | |
References | () http://www.informationweek.com/news/security/vulnerabilities/229700031 - | |
References | () http://www.networkworld.com/community/node/74259 - | |
References | () http://www.theregister.co.uk/2011/05/25/microsoft_internet_explorer_cookiejacking/ - | |
References | () http://www.youtube.com/watch?v=V95CX-3JpK0 - | |
References | () http://www.youtube.com/watch?v=VsSkcnIFCxM - | |
References | () https://sites.google.com/site/tentacoloviola/cookiejacking/Cookiejacking2011_final.ppt - |
07 Nov 2023, 02:07
Type | Values Removed | Values Added |
---|---|---|
References |
|
|
Information
Published : 2011-06-03 17:55
Updated : 2025-04-11 00:51
NVD link : CVE-2011-2382
Mitre link : CVE-2011-2382
CVE.ORG link : CVE-2011-2382
JSON object : View
Products Affected
microsoft
- ie
- internet_explorer
CWE
CWE-20
Improper Input Validation