ID CVE-2009-3003
Summary Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.
References
Vulnerable Configurations
  • cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
    cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
CVSS
Base: 4.3 (as of 19-09-2017 - 01:29)
Impact:
Exploitability:
CWE NVD-CWE-Other
CAPEC
Access
VectorComplexityAuthentication
NETWORK MEDIUM NONE
Impact
ConfidentialityIntegrityAvailability
NONE PARTIAL NONE
assigner via4 cve@mitre.org
cvss-vector via4 AV:N/AC:M/Au:N/C:N/I:P/A:N
oval via4
accepted 2011-08-15T04:00:09.212-04:00
class vulnerability
contributors
name Dragos Prisaca
organization Symantec Corporation
definition_extensions
  • comment Microsoft Internet Explorer 6 is installed
    oval oval:org.mitre.oval:def:563
  • comment Microsoft Internet Explorer 7 is installed
    oval oval:org.mitre.oval:def:627
  • comment Microsoft Internet Explorer 8 is installed
    oval oval:org.mitre.oval:def:6210
description Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.
family windows
id oval:org.mitre.oval:def:12817
status accepted
submitted 2011-06-28T13:00:00
title Microsoft Internet Explorer 6 through 8 spoofing vulnerability
version 6
refmap via4
misc http://lostmon.blogspot.com/2009/08/multiple-browsers-fake-url-folder-file.html
secunia 36334
xf ie-windowopen-spoofing(53005)
vulnerable_product via4
  • cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
  • cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
Last major update 19-09-2017 - 01:29
Published 28-08-2009 - 15:30
Back to Top