PT-2009-1388 · Microsoft · Internet Explorer

Published 2009-01-20 · Updated 2017-08-08 · CVE-2008-5912

Positive Technologies (AI Summary)

CVSS v2.0

2.1

Low

Base vector

AV:N/AC:H/Au:S/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer (affected versions not specified)

Description The issue concerns an unspecified function in the JavaScript implementation that creates and exposes a temporary footprint when a user is logged in to a website. This makes it easier for remote attackers to trick users into acting upon a spoofed pop-up message, facilitating an in-session phishing attack.

Recommendations At the moment, there is no information about a newer version that contains a fix for this vulnerability.

Related Identifiers

CVE-2008-5912

Affected Products

Internet Explorer

References · 7

• https://nvd.nist.gov/vuln/detail/CVE-2008-5912 · Security Note
• http://darkreading.com/security/attacks/showArticle.jhtml?articleID=212900161 · Note
• https://exchange.xforce.ibmcloud.com/vulnerabilities/48173 · Note
• http://infoworld.com/article/09/01/13/Browser_bug_could_allow_phishing_without_email_1.html · Note
• http://arstechnica.com/news.ars/post/20090113-new-method-of-phishmongering-could-fool-experienced-users.html · Note
• http://trusteer.com/files/In-session-phishing-advisory-2.pdf · Note
• http://securityfocus.com/bid/33276 · Note