CVE-2008-2947

Severity Score

6.8

*CVSS v2

Exploit Likelihood

*EPSS

Affected Versions

*CPE

Public Exploits

*Multiple Sources

Exploited in Wild

*KEV

Decision

*SSVC

Descriptions

Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a (1) location or (2) location.href property, related to incorrect determination of the origin of web script, aka "Window Location Property Cross-Domain Vulnerability." NOTE: according to Microsoft, CVE-2008-2948 and CVE-2008-2949 are duplicates of this issue, probably different attack vectors.

Vulnerabilidad de dominios cruzados en Microsoft Internet Explorer 6 permite a atacantes remotos acceder a información restringida de otros dominios a través de JavaScript que utiliza tipos de datos Object para el valor de una propiedad (1) location o (2) location.href.

*Credits: N/A

CVSS Scores

NISTv2 6.8

Attack Vector

Network

Attack Complexity

Medium

Authentication

None

Confidentiality

Partial

Integrity

Partial

Availability

Partial

* Common Vulnerability Scoring System

SSVC

Decision:-

Exploitation

Automatable

Tech. Impact

* Organization's Worst-case Scenario

Timeline

2008-06-30 CVE Reserved
2008-06-30 CVE Published
2024-08-07 CVE Updated
2024-08-07 First Exploit
2024-09-19 EPSS Updated
---------- Exploited in Wild
---------- KEV Due Date

CWE

CWE-284: Improper Access Control

CAPEC

References (13)

URL	Tag	Source
http://blogs.zdnet.com/security/?p=1348	Media Coverage
http://www.kb.cert.org/vuls/id/923508	Third Party Advisory
http://www.securityfocus.com/bid/29960	Third Party Advisory
http://www.securitytracker.com/id?1020382	Third Party Advisory
http://www.us-cert.gov/cas/techalerts/TA08-288A.html	Third Party Advisory
http://www.vupen.com/english/advisories/2008/1940/references	Broken Link
http://www.vupen.com/english/advisories/2008/2809	Broken Link
https://exchange.xforce.ibmcloud.com/vulnerabilities/43366	Vdb Entry
https://exchange.xforce.ibmcloud.com/vulnerabilities/45565	Vdb Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A5901	Signature

URL	Date	SRC
http://www.ph4nt0m.org-a.googlepages.com/PSTZine_0x02_0x04.txt	2024-08-07

URL	Date	SRC

URL	Date	SRC
http://marc.info/?l=bugtraq&m=122479227205998&w=2	2018-10-12
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058	2018-10-12

Affected Vendors, Products, and Versions

Vendor		Product				Version		Other		Status
Vendor	Product	Version	Other	Status	<-- -->	Vendor	Product	Version	Other	Status
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				5.01 Search vendor "Microsoft" for product "Internet Explorer" and version "5.01"		sp4		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				6 Search vendor "Microsoft" for product "Internet Explorer" and version "6"		-		Affected
Microsoft Search vendor "Microsoft"		Internet Explorer Search vendor "Microsoft" for product "Internet Explorer"				7 Search vendor "Microsoft" for product "Internet Explorer" and version "7"		-		Affected