CVE-2004-2383
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains…
Public exploit code
Working exploit or proof of concept code has been published for this vulnerability. Treat unpatched systems as at risk.
- Microsoft Internet Explorer 5/6 - Cross-Domain Event Leakage2004-02-27 · remote · windows · Verified
Impact
Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains via an HTML document with Javascript that is outside a frameset that includes the target domain, then forcing the frameset to maintain focus. NOTE: the discloser claimed that the vendor does not categorize this as a vulnerability, but it can be used in a spoofing scenario; the discloser provides alternate scenarios. Spoofing scenarios are currently included in CVE.
Affected products
| Vendor | Product | Affected versions |
|---|---|---|
| Microsoft | Ie | Version 6.0 |
| Microsoft | Internet Explorer | Versions 5.5, 6.0 |
References
- NVD record
- CVE.org record
- http://www.idefense.com/application/poi/display?id=77&type=vulnerabilities&flashstatus=false
- http://www.securityfocus.com/bid/9761
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15337
- http://www.idefense.com/application/poi/display?id=77&type=vulnerabilities&flashstatus=false
- http://www.securityfocus.com/bid/9761
- https://exchange.xforce.ibmcloud.com/vulnerabilities/15337