NetSight
IP …
critical9.3Public exploit code

CVE-2003-1026

Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the hi…

Public exploit code

Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.

Impact

Internet Explorer 5.01 through 6 SP1 allows remote attackers to bypass zone restrictions via a javascript protocol URL in a sub-frame, which is added to the history list and executed in the top window's zone when the history.back (back) function is called, as demonstrated by BackToFramedJpu, aka the "Travel Log Cross Domain Vulnerability."

Affected products

VendorProductAffected versions
MicrosoftIe
Version 6.0
MicrosoftInternet Explorer
Versions 5.0, 5.0.1, 5.5, 6.0

Weakness classification

CWE-264

References