CVE-2002-0648 The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "...
MediumCVSS 5.0
EPSS 48.4%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
The legacy <script> data-island capability for XML in Microsoft Internet Explorer 5.01, 5.5, and 6.0 allows remote attackers to read arbitrary XML files, and portions of other files, via a URL whose "src" attribute redirects to a local file.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 5.01 | No fix listed |
| Microsoft internet explorer | = 5.01-sp1 | No fix listed |
| Microsoft internet explorer | = 5.01-sp2 | No fix listed |
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
References
- 20020823 Accessing remote/local content in IE (GM#009-IE) mailing-list
- ie-xml-redirect-read-files(9936) vdb-entry
- 5560 vdb-entry
- MS02-047 vendor-advisory
- oval:org.mitre.oval:def:1026 signature vdb-entry
- oval:org.mitre.oval:def:1148 signature vdb-entry
- oval:org.mitre.oval:def:1207 signature vdb-entry
- oval:org.mitre.oval:def:608 signature vdb-entry
- oval:org.mitre.oval:def:776 signature vdb-entry