PT-2010-2254 · Microsoft · Internet Explorer

Paul Stone · Publicado 2010-03-31 · Atualizado 2023-12-07 · CVE-2010-0494

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:P/I:N/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6 through 8

Description The issue allows remote attackers to bypass the Same Origin Policy and conduct cross-site scripting (XSS) attacks via a crafted HTML document. This can occur when a user drags one browser window across another. An information disclosure vulnerability also exists, which could allow script to gain access to a browser window in another domain or Internet Explorer zone by constructing a specially crafted Web page.

Recommendations For Microsoft Internet Explorer versions 6 through 8, consider disabling the ability to drag browser windows across each other as a temporary workaround until a patch is available. Restrict access to sensitive information when viewing web pages from different domains or zones to minimize the risk of information disclosure.

Correção

Information Disclosure

Enumeração de Fraquezas

CWE-200

Identificadores relacionados

CVE-2010-0494

Produtos afetados

Internet Explorer

Referências · 10

• http://us-cert.gov/cas/techalerts/TA10-089A.html · Nota
• https://docs.microsoft.com/security-updates/securitybulletins/2010/MS10-018 · Nota
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-018 · Aviso do Fabricante
• https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A8553 · Nota
• https://nvd.nist.gov/vuln/detail/CVE-2010-0494 · Nota de Segurança
• http://vupen.com/english/advisories/2010/0744 · Aviso do Fabricante
• http://us-cert.gov/cas/techalerts/TA10-068A.html · Nota
• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2010-0494 · Nota de Segurança
• http://securityfocus.com/bid/39047 · Correção
• http://securitytracker.com/id?1023773 · Nota