CVE-2002-1217 Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unautho...
HighCVSS 7.5
EPSS 49.8%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-Frame scripting vulnerability in the WebBrowser control as used in Internet Explorer 5.5 and 6.0 allows remote attackers to execute arbitrary code, read arbitrary files, or conduct other unauthorized activities via script that accesses the Document property, which bypasses <frame> and <iframe> domain restrictions.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 5.5-sp1 | No fix listed |
| Microsoft internet explorer | = 5.5-sp2 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
References
- 20021015 Internet Explorer : The D-Day mailing-list
- 20021015 Internet Explorer : The D-Day mailing-list
- 20021015 Internet Explorer : The D-Day mailing-list
- security.greymagic.com exploit patch vendor-advisory
- N-018 government-resource third-party-advisory
- ie-iframe-document-script-execution(10371) vdb-entry
- 5963 vdb-entry
- MS02-066 vendor-advisory
- oval:org.mitre.oval:def:272 signature vdb-entry
- oval:org.mitre.oval:def:333 signature vdb-entry