Vulnerability 12249 - CERT Civis.Net

Vulnerability Name:

CCN-12249

Published:

2003-06-04

Updated:

2003-06-04

Summary:

The FTP implementation of Microsoft Internet Explorer is vulnerable to cross-site scripting, caused by a vulnerability when the "classic" viewing setting is used. A remote attacker could embed malicious script in an FTP URL, which would be executed in the victim's Web browser within the security context of the hosting site, once the link is clicked.

CVSS v3 Severity:

3.7 Low (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): High Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): None Integrity (I): Low Availibility (A): None

CVSS v2 Severity:

2.6 Low (CCN CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N)
2.4 Low (CCN Temporal CVSS v2 Vector: AV:N/AC:H/Au:N/C:N/I:P/A:N/E:H/RL:U/RC:UR)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): High Athentication (Au): None
Impact Metrics:	Confidentiality (C): None Integrity (I): Partial Availibility (A): None

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: Full-Disclosure Mailing List, Wed Jun 04 2003 - 12:32:05 CDT
(Another) Microsoft Internet Explorer FTP Security Hole

Source: CCN
Type: BID-7810
Microsoft Internet Explorer Classic Mode FTP Client Cross Domain Scripting Vulnerability

Source: XF
Type: UNKNOWN
ie-ftp-classic-xss(12249)

Vulnerable Configuration:

Configuration CCN 1:

cpe:/a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*

OR cpe:/a:microsoft:internet_explorer:5.5:-:*:*:*:*:*:*

OR cpe:/a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK