PT-2008-4869 · Microsoft · Internet Explorer

Lee Dagon · Publicado 2008-10-14 · Atualizado 2025-01-17 · CVE-2008-3474

Positive Technologies (AI Summary)

CVSS v3.1

6.5

Média

Vetor base

AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 7

Description The issue allows remote attackers to bypass the intended cross-domain security policy and obtain sensitive information via a crafted HTML document. This is due to the improper determination of the domain or security zone of origin of web script. An attacker could exploit this by constructing a specially crafted Web page, potentially leading to information disclosure if a user views the Web page.

Recommendations For Microsoft Internet Explorer versions 6 through 7, update to a newer version to mitigate the risk. As a temporary workaround, consider restricting access to sensitive information when browsing untrusted websites. Avoid using Internet Explorer to access sensitive data until the issue is resolved.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2008-3474

Produtos afetados

Internet Explorer

Referências · 12

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2008-3474 · Nota de Segurança
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2008/ms08-058 · Aviso do Fabricante
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45854 · Nota
• http://vupen.com/english/advisories/2008/2809 · Nota
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A13299 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-3474 · Nota de Segurança
• http://securitytracker.com/id?1021047 · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2008/MS08-058 · Nota
• http://marc.info/?l=bugtraq&m=122479227205998&w=2 · Aviso do Fabricante
• https://t.me/cvenotify/107778 · Publicação no Telegram
• https://exchange.xforce.ibmcloud.com/vulnerabilities/45565 · Nota
• http://us-cert.gov/cas/techalerts/TA08-288A.html · Nota