| Vulnerability Name: | CCN-11250 | ||||||
| Published: | 2003-02-03 | ||||||
| Updated: | 2003-02-03 | ||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to read known files from a victim's computer, caused by a vulnerability regarding the dragDrop() method. A remote attacker could create a malicious Web page that uses JavaScript to cause portions of files to be dropped into an HTML upload control, if the victim activates the handleOnmousedown() action by clicking the mouse button. An attacker could use this vulnerability to read files with the same privileges as the victim. | ||||||
| CVSS v3 Severity: | 5.3 Medium (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:N/A:N)
| ||||||
| CVSS v2 Severity: | 5.0 Medium (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:N/A:N)
| ||||||
| Vulnerability Consequences: | Obtain Information | ||||||
| References: | Source: CCN Type: BugTraq Mailing List, Mon Feb 03 2003 - 08:25:10 CST internet explorer local file reading Source: CCN Type: BID-6749 Microsoft Internet Explorer dragDrop Method Local File Reading Vulnerability Source: XF Type: UNKNOWN ie-dragdrop-read-files(11250) | ||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||
| BACK | |||||||