PT-2013-1966 · Microsoft · Internet Explorer
Published
2013-01-22
·
Updated
2013-09-03
·
CVE-2012-6502
CVSS v2.0
2.6
Low
| Vector | AV:N/AC:H/Au:N/C:P/I:N/A:N |
Name of the Vulnerable Software and Affected Versions
Microsoft Internet Explorer versions prior to 10
Description
The issue allows remote attackers to obtain sensitive information about the existence of files and read certain data from files via a UNC share pathname in the SRC attribute of a SCRIPT element. This can be demonstrated by reading a name-value pair from a local file via a 127.0.0.1C$ sequence.
Recommendations
For versions prior to 10, update to version 10 or later to resolve the issue. As a temporary workaround, consider restricting access to the SRC attribute of the SCRIPT element to minimize the risk of exploitation. Avoid using the UNC share pathname in the SRC attribute until the issue is resolved.
Fix
Information Disclosure
Found an issue in the description? Have something to add? Feel free to write us 👾
Weakness Enumeration
Related Identifiers
Affected Products
Internet Explorer