CVE-2015-0072 Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involv...
MediumCVSS 4.3
EPSS 71.7%
Framework module
- Published
- Updated
- Exploit status
- Public exploit available
Description
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Affected products
| Product | Affected versions | Fixed in |
|---|---|---|
| Microsoft internet explorer | = 9 | No fix listed |
| Microsoft internet explorer | = 10 | No fix listed |
| Microsoft internet explorer | = 11 | No fix listed |
References
- community.websense.com
- innerht.ml exploit
- packetstormsecurity.com exploit
- 20150131 Major Internet Explorer Vulnerability - NOT Patched mailing-list
- 62658 third-party-advisory
- www.pcworld.com
- 20150209 Cookie hijacking: Internet Explorer UXSS (CVE-2015-0072) mailing-list
- 72489 vdb-entry
- 1031888 vdb-entry
- MS15-018 vendor-advisory
- ms-ie-cve20150072-xss(100606) vdb-entry
- nakedsecurity.sophos.com