Vulnerability 8276 - CERT Civis.Net

Vulnerability Name:

CCN-8276

Published:

2001-08-15

Updated:

2001-08-15

Summary:

Many popular Web browsers and mail programs are vulnerable to malicious HTML form attacks. A remote attacker can create a malicious HTML form to send arbitrary data to any service running on the victim's system. This could allow a remote attacker to gain elevated privileges on the victim's system when the form is viewed.

CVSS v3 Severity:

7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)

Exploitability Metrics:	Attack Vector (AV): Network Attack Complexity (AC): Low Privileges Required (PR): None User Interaction (UI): None
Scope:	Scope (S): Unchanged
Impact Metrics:	Confidentiality (C): Low Integrity (I): Low Availibility (A): Low

CVSS v2 Severity:

7.5 High (CCN CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)

Exploitability Metrics:	Access Vector (AV): Network Access Complexity (AC): Low Athentication (Au): None
Impact Metrics:	Confidentiality (C): Partial Integrity (I): Partial Availibility (A): Partial

Vulnerability Consequences:

Gain Access

References:

Source: CCN
Type: BugTraq Mailing List, Wed Aug 15 2001 - 02:20:19 CDT
HTML Form Protocol Attack

Source: CCN
Type: BugTraq Mailing List, Wed Feb 06 2002 - 19:50:43 CST
Web Browsers vulnerable to the Extended HTML Form Attack (IE and OPERA)

Source: CCN
Type: US-CERT VU#476267
Standard HTML form implementation allows access to IMAP, SMTP, NNTP, POP3, and other services via crafted HTML page

Source: CCN
Type: BID-3181
Multiple Vendor HTML Form Protocol Vulnerability

Source: XF
Type: UNKNOWN
html-form-access-services(8276)

Vulnerable Configuration:

Configuration CCN 1:

cpe:/a:opera:opera_browser:*:*:*:*:*:*:*:*

OR cpe:/a:lynx:lynx:*:*:*:*:*:*:*:*

OR cpe:/a:microsoft:ie:*:*:*:*:*:*:*:*

OR cpe:/a:netscape:communicator:*:*:*:*:*:*:*:*

OR cpe:/a:microsoft:outlook:*:*:*:*:*:*:*:*

OR cpe:/a:microsoft:outlook_express:*:*:*:*:*:*:*:*

Denotes that component is vulnerable

BACK