PT-2014-7190 · Microsoft · Internet Explorer

Published 2014-12-09 · Updated 2018-10-12 · CVE-2014-6365

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 8 through 11

Description The issue allows remote attackers to bypass the XSS filter via a crafted attribute of an element in an HTML document. This could lead to information disclosure, as initially disabled scripts could run in the wrong security context. An attacker who successfully exploited this issue could cause script code to run on another user's system, potentially taking any action permitted to a third-party website. The issue could only be exploited if the user clicked on a hypertext link, either in an HTML email or if the user visited an attacker's website or a website containing content under the attacker’s control.

Recommendations For Microsoft Internet Explorer versions 8 through 11, at the moment, there is no information about a newer version that contains a fix for this issue.

Fix

RCE

Weakness Enumeration

CWE-20

Related Identifiers

CVE-2014-6365

Affected Products

Internet Explorer

References · 4

• http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2014-6365 · Security Note
• https://nvd.nist.gov/vuln/detail/CVE-2014-6365 · Security Note
• https://docs.microsoft.com/en-us/security-updates/securitybulletins/2014/ms14-080 · Vendor Advisory
• http://technet.microsoft.com/security/bulletin/ms14-080 · Note