CVE-2003-0446 Cross-site scripting (XSS) in Internet Explorer 5.5 and 6.0, possibly in a component that is also used by other Microsoft products, allows remote attackers to insert arbitrary web script via an XML fi...
MediumCVSS 4.3
EPSS 23.0%
Public exploit
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) in Internet Explorer 5.5 and 6.0, possibly in a component that is also used by other Microsoft products, allows remote attackers to insert arbitrary web script via an XML file that contains a parse error, which inserts the script in the resulting error message.
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 5.5 | No fix listed |
| Microsoft internet explorer | = 6.0 | No fix listed |
References
- 20030617 Re: Cross-Site Scripting in Unparsable XML Files (GM#013-IE) mailing-list
- 20030617 Cross-Site Scripting in Unparsable XML Files (GM#013-IE) mailing-list
- 20030617 Cross-Site Scripting in Unparsable XML Files (GM#013-IE) mailing-list
- 20030617 Re: [Full-Disclosure] Cross-Site Scripting in Unparsable XML Files mailing-list
- 20030617 Cross-Site Scripting in Unparsable XML Files (GM#013-IE) mailing-list
- 9055 third-party-advisory
- security.greymagic.com exploit vendor-advisory
- 3065 vdb-entry
- 7938 vdb-entry
- ie-msxml-xss(12334) vdb-entry