CVE-2011-2383

Published Jun 3, 2011

Last updated a year ago

Overview

Description: Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.
Source: cve@mitre.org
NVD status: Modified

Hype score: Not currently trending

Risk scores

CVSS 2.0

Type: Primary
Base score: 4.3
Impact score: 2.9
Exploitability score: 8.6
Vector string: AV:N/AC:M/Au:N/C:P/I:N/A:N

Weaknesses

nvd@nist.gov: CWE-20

Configurations

[
  {
    "nodes": [
      {
        "negate": false,
        "cpeMatch": [
          {
            "criteria": "cpe:2.3:a:microsoft:ie:9:beta:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4594B15E-22ED-4DDE-B35A-2CF8F4629729"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "4FF2A1DF-843B-4276-AC4E-EF6BC3CACCA9",
            "versionEndIncluding": "9"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:3.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1BBF9241-A175-438C-A793-3D245BE2AE35"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:4.0:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A5B815D9-BC21-4A17-AF00-B8AD181027D7"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:5:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "B4071D03-D955-4C1B-ACD8-A864F7D0FA02"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "693D3C1C-E3E4-49DB-9A13-44ADDFF82507"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "1A33FA7F-BB2A-4C66-B608-72997A2BD1DB"
          },
          {
            "criteria": "cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*",
            "vulnerable": true,
            "matchCriteriaId": "A52E757F-9B41-43B4-9D67-3FEDACA71283"
          }
        ],
        "operator": "OR"
      }
    ]
  }
]

Overview

Social media

Risk scores

CVSS 2.0

Weaknesses

Configurations

References