| Vulnerability Name: | CVE-2002-1254 (CCN-10432) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2021-07-23 | ||||||||||||
| Summary: | Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: BUGTRAQ Type: UNKNOWN 20021022 Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: MISC Type: UNKNOWN http://security.greymagic.com/adv/gm012-ie/ Source: CIAC Type: UNKNOWN N-018 Source: XF Type: UNKNOWN ie-cache-elementfrompoint-dom-access(10435) Source: XF Type: UNKNOWN ie-cache-getelementbyid-dom-access(10436) Source: XF Type: UNKNOWN ie-cache-getelementsbyname-dom-access(10437) Source: XF Type: UNKNOWN ie-cache-getelementsbytagname-dom-access(10438) Source: XF Type: UNKNOWN ie-cache-execcommand-dom-access(10439) Source: CCN Type: Microsoft Corporation Web site What You Should Know About Microsoft Security Bulletin MS02-066 Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: BID Type: Exploit, Patch, Vendor Advisory 6028 Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: MS Type: UNKNOWN MS02-066 Source: XF Type: UNKNOWN ie-cache-showmodaldialog-dom-access(10432) Source: XF Type: UNKNOWN ie-cache-showmodaldialog-dom-access(10432) Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:388 Source: OVAL Type: UNKNOWN oval:org.mitre.oval:def:408 | ||||||||||||
| Vulnerable Configuration: | Configuration 1: Configuration CCN 1:  Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10433) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2018-10-12 | ||||||||||||
| Summary: | Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods." | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Type: | CWE-Other | ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: MITRE Type: CNA CVE-2002-1262 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: CIAC Information Bulletin N-021 Microsoft Cumulative Patch for Internet Explorer Source: CCN Type: US-CERT VU#162097 Microsoft Internet Explorer does not adequately validate references to cached objects and methods Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: NTBugTraq Mailing List, Thu, 5 Dec 2002 14:42:08 +0100 Notes on MS02-068, extensive downplaying of severity Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-external-dom-access(10433) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10434) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2002-10-22 | ||||||||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to execute malicious JavaScript in restricted domains by using the createRange cached object to bypass security domain restrictions and access any page's Document Object Model (DOM). If a remote attacker creates a malicious Web page that opens a window on the attacker's own site that uses the affected cached object, but then changes the URL of the window to a victim's page, the cached object could be used to bypass restrictions and access the victim page's DOM. This vulnerability could allow an attacker to steal cookies from Web sites, gain access to Web site content, and read files or execute program's on the victim's computer. | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: Microsoft Corporation Web site Internet Explorer Home Page Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-createrange-dom-access(10434) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10435) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2002-10-22 | ||||||||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to execute malicious JavaScript in restricted domains by using the elementFromPoint cached object to bypass security domain restrictions and access any page's Document Object Model (DOM). If a remote attacker creates a malicious Web page that opens a window on the attacker's own site that uses the affected cached object, but then changes the URL of the window to a victim's page, the cached object could be used to bypass restrictions and access the victim page's DOM. This vulnerability could allow an attacker to steal cookies from Web sites, gain access to Web site content, and read files or execute program's on the victim's computer. | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: Microsoft Corporation Web site Internet Explorer Home Page Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-elementfrompoint-dom-access(10435) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10436) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2002-10-22 | ||||||||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to execute malicious JavaScript in restricted domains by using the getElementById cached object to bypass security domain restrictions and access any page's Document Object Model (DOM). If a remote attacker creates a malicious Web page that opens a window on the attacker's own site that uses the affected cached object, but then changes the URL of the window to a victim's page, the cached object could be used to bypass restrictions and access the victim page's DOM. This vulnerability could allow an attacker to steal cookies from Web sites, gain access to Web site content, and read files or execute program's on the victim's computer. | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: Microsoft Corporation Web site Internet Explorer Home Page Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-getelementbyid-dom-access(10436) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10437) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2002-10-22 | ||||||||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to execute malicious JavaScript in restricted domains by using the getElementsByName cached object to bypass security domain restrictions and access any page's Document Object Model (DOM). If a remote attacker creates a malicious Web page that opens a window on the attacker's own site that uses the affected cached object, but then changes the URL of the window to a victim's page, the cached object could be used to bypass restrictions and access the victim page's DOM. This vulnerability could allow an attacker to steal cookies from Web sites, gain access to Web site content, and read files or execute program's on the victim's computer. | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: Microsoft Corporation Web site Internet Explorer Home Page Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-getelementsbyname-dom-access(10437) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10438) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2002-10-22 | ||||||||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to execute malicious JavaScript in restricted domains by using the getElementsByTagName cached object to bypass security domain restrictions and access any page's Document Object Model (DOM). If a remote attacker creates a malicious Web page that opens a window on the attacker's own site that uses the affected cached object, but then changes the URL of the window to a victim's page, the cached object could be used to bypass restrictions and access the victim page's DOM. This vulnerability could allow an attacker to steal cookies from Web sites, gain access to Web site content, and read files or execute program's on the victim's computer. | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: Microsoft Corporation Web site Internet Explorer Home Page Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-getelementsbytagname-dom-access(10438) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10439) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2002-10-22 | ||||||||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to execute malicious JavaScript in restricted domains by using the execCommand cached object to bypass security domain restrictions and access any page's Document Object Model (DOM). If a remote attacker creates a malicious Web page that opens a window on the attacker's own site that uses the affected cached object, but then changes the URL of the window to a victim's page, the cached object could be used to bypass restrictions and access the victim page's DOM. This vulnerability could allow an attacker to gain read access to a known file on the victim's computer. | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: CIAC Information Bulletin N-018 Microsoft Cumulative Patch for Internet Explorer Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS02-068 Cumulative Patch for Internet Explorer (324929) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Security Bulletin MS03-015 Cumulative Patch for Internet Explorer (813489) Source: CCN Type: Microsoft Security Bulletin MS03-020 Cumulative Patch for Internet Explorer (818529) Source: CCN Type: Microsoft Security Bulletin MS03-032 Cumulative Patch for Internet Explorer (822925) Source: CCN Type: Microsoft Security Bulletin MS03-040 Cumulative Patch for Internet Explorer (828750) Source: CCN Type: Microsoft Security Bulletin MS03-048 Cumulative Security Update for Internet Explorer (824145) Source: CCN Type: Microsoft Security Bulletin MS04-004 Cumulative Security Update for Internet Explorer (832894) Source: CCN Type: Microsoft Security Bulletin MS04-025 Cumulative Security Update for Internet Explorer (867801) Source: CCN Type: Microsoft Security Bulletin MS04-038 Cumulative Security Update for Internet Explorer (834707) Source: CCN Type: Microsoft Security Bulletin MS04-040 Cumulative Security Update for Internet Explorer (889293) Source: CCN Type: Microsoft Security Bulletin MS05-014 Cumulative Security Update for Internet Explorer (867282) Source: CCN Type: Microsoft Security Bulletin MS05-020 Cumulative Security Update for Internet Explorer (890923) Source: CCN Type: Microsoft Security Bulletin MS05-025 Cumulative Security Update for Internet Explorer (883939) Source: CCN Type: Microsoft Security Bulletin MS05-038 Cumulative Security Update for Internet Explorer (896727) Source: CCN Type: Microsoft Security Bulletin MS05-052 Cumulative Security Update for Internet Explorer (896688) Source: CCN Type: Microsoft Security Bulletin MS05-054 Cumulative Security Update for Internet Explorer (905915) Source: CCN Type: Microsoft Security Bulletin MS06-004 Cumulative Security Update for Internet Explorer (910620) Source: CCN Type: Microsoft Security Bulletin MS06-013 Cumulative Security Update for Internet Explorer (912812) Source: CCN Type: Microsoft Security Bulletin MS06-021 Cumulative Security Update for Internet Explorer (916281) Source: CCN Type: Microsoft Security Bulletin MS06-042 Cumulative Security Update for Internet Explorer (918899) Source: CCN Type: Microsoft Security Bulletin MS06-067 Cumulative Security Update for Internet Explorer (922760) Source: CCN Type: Microsoft Security Bulletin MS06-072 Cumulative Security Update for Internet Explorer (925454) Source: CCN Type: Microsoft Security Bulletin MS07-016 Cumulative Security Update for Internet Explorer (928090) Source: CCN Type: Microsoft Security Bulletin MS07-027 Cumulative Security Update for Internet Explorer (931768) Source: CCN Type: Microsoft Security Bulletin MS07-033 Cumulative Security Update for Internet Explorer (933566) Source: CCN Type: Microsoft Security Bulletin MS07-045 Cumulative Security Update for Internet Explorer (937143) Source: CCN Type: Microsoft Security Bulletin MS07-057 Cumulative Security Update for Internet Explorer (939653) Source: CCN Type: Microsoft Security Bulletin MS07-069 Cumulative Security Update for Internet Explorer (942615) Source: CCN Type: Microsoft Security Bulletin MS08-010 Cumulative Security Update for Internet Explorer (944533) Source: CCN Type: Microsoft Security Bulletin MS08-024 Cumulative Security Update for Internet Explorer (947864) Source: CCN Type: Microsoft Security Bulletin MS08-031 Cumulative Security Update for Internet Explorer (950759) Source: CCN Type: Microsoft Security Bulletin MS08-045 Cumulative Security Update for Internet Explorer (953838) Source: CCN Type: Microsoft Security Bulletin MS08-058 Cumulative Security Update for Internet Explorer (956390) Source: CCN Type: Microsoft Corporation Web site Internet Explorer Home Page Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-execcommand-dom-access(10439) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Vulnerability Name: | CVE-2002-1254 (CCN-10440) | ||||||||||||
| Assigned: | 2002-10-22 | ||||||||||||
| Published: | 2002-10-22 | ||||||||||||
| Updated: | 2002-10-22 | ||||||||||||
| Summary: | Microsoft Internet Explorer could allow a remote attacker to execute malicious JavaScript in restricted domains by using the clipboardData cached object to bypass security domain restrictions and access any page's Document Object Model (DOM). If a remote attacker creates a malicious Web page that opens a window on the attacker's own site that uses the affected cached object, but then changes the URL of the window to a victim's page, the cached object could be used to bypass restrictions and access the victim page's DOM. This vulnerability could allow an attacker to gain read and write access to the victim's clipboard. | ||||||||||||
| CVSS v3 Severity: | 7.3 High (CCN CVSS v3.1 Vector: CVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:L/I:L/A:L)
| ||||||||||||
| CVSS v2 Severity: | 7.5 High (CVSS v2 Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P)
| ||||||||||||
| Vulnerability Consequences: | Gain Access | ||||||||||||
| References: | Source: MITRE Type: CNA CVE-2002-1254 Source: CCN Type: GreyMagic Security Advisory GM#012-IE Vulnerable cached objects in IE (9 advisories in 1) Source: CCN Type: Microsoft Security Bulletin MS02-066 Cumulative Patch for Internet Explorer (Q328970) Source: CCN Type: Microsoft Security Bulletin MS03-004 Cumulative Patch for Internet Explorer (810847) Source: CCN Type: Microsoft Corporation Web site Internet Explorer Home Page Source: CCN Type: NTBugTraq Mailing List, Mon, 25 Nov 2002 19:07:32 +0200 Re: MS02-066 - fixes, gaps and incorrect statements Source: CCN Type: BID-6028 Multiple Microsoft Internet Explorer Cached Objects Zone Bypass Vulnerability Source: XF Type: UNKNOWN ie-cache-clipboarddata-dom-access(10440) | ||||||||||||
| Vulnerable Configuration: | Configuration CCN 1: Denotes that component is vulnerable | ||||||||||||
| Oval Definitions | |||||||||||||
| |||||||||||||
| BACK | |||||||||||||