PT-2008-6612 · Microsoft · Internet Explorer

Publicado 2008-12-12 · Atualizado 2018-10-11 · CVE-2008-5551

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8.0 Beta 2

Description The issue allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting data at two different positions within an HTML document, related to STYLE elements and the CSS expression property. This is related to a "double injection" technique.

Recommendations For Microsoft Internet Explorer version 8.0 Beta 2, consider disabling the CSS expression property as a temporary workaround until a patch is available. Restrict access to STYLE elements to minimize the risk of exploitation. Avoid using the CSS expression property in STYLE elements until the issue is resolved.

Exploit

Correção

XSS

Enumeração de Fraquezas

CWE-79

Identificadores relacionados

CVE-2008-5551

Produtos afetados

Internet Explorer

Referências · 6

• 🔥 https://exploit-db.com/exploits/32654 · Exploit
• 🔥 http://securityfocus.com/bid/32780 · Exploit
• http://securityfocus.com/archive/1/499124/100/0/threaded · Nota
• http://securityreason.com/securityalert/4724 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2008-5551 · Nota de Segurança
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47277 · Nota