PT-2008-6612 · Microsoft · Internet Explorer

Published 2008-12-12 · Updated 2018-10-11 · CVE-2008-5551

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer version 8.0 Beta 2

Description The issue allows remote attackers to bypass the XSS protection mechanism and conduct XSS attacks by injecting data at two different positions within an HTML document, related to STYLE elements and the CSS expression property. This is related to a "double injection" technique.

Recommendations For Microsoft Internet Explorer version 8.0 Beta 2, consider disabling the CSS expression property as a temporary workaround until a patch is available. Restrict access to STYLE elements to minimize the risk of exploitation. Avoid using the CSS expression property in STYLE elements until the issue is resolved.

Exploit

Fix

XSS

Weakness Enumeration

CWE-79

Related Identifiers

CVE-2008-5551

Affected Products

Internet Explorer

References · 6

• 🔥 https://exploit-db.com/exploits/32654 · Exploit
• 🔥 http://securityfocus.com/bid/32780 · Exploit
• https://nvd.nist.gov/vuln/detail/CVE-2008-5551 · Security Note
• http://securityfocus.com/archive/1/499124/100/0/threaded · Note
• http://securityreason.com/securityalert/4724 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/47277 · Note