Vulnerability in Microsoft Internet Explorer
CVE-2008-2947
Cross-domain vulnerability in Microsoft Internet Explorer 5.01 SP4, 6, and 7 allows remote attackers to access restricted information from other domains via JavaScript that uses the Object data type for the value of a (1) location or (2) location.href property, related to incorrect determination of the origin of web script, aka "Window Location Property Cross-Domain Vulnerability." NOTE: according to Microsoft, CVE-2008-2948 and CVE-2008-2949 are duplicates of this issue, probably different attack vectors.
EPSS: 0.247 (97.7th percentile) — read the EPSS interpretation.
Affected products
- Microsoft Internet_explorer — versions 5.01, 6, 7
- N/a — versions n/a
Weakness classification (CWE)
References
- cve@mitre.org (vdb-entry, x_refsource_XF)
- cve@mitre.org (x_refsource_HP, vendor-advisory, Mailing List)
- cve@mitre.org (x_refsource_MS, vendor-advisory)
- cve@mitre.org (vdb-entry, Broken Link, x_refsource_VUPEN)
- cve@mitre.org (Permissions Required, x_refsource_SECUNIA, Vendor Advisory, third-party-advisory)
- cve@mitre.org (vdb-entry, Broken Link, x_refsource_VUPEN)
- cve@mitre.org (US Government Resource, x_refsource_CERT-VN, Third Party Advisory, third-party-advisory)
- cve@mitre.org (signature, x_refsource_OVAL, vdb-entry)
- cve@mitre.org (Exploit, x_refsource_MISC)
- cve@mitre.org (VDB Entry, Third Party Advisory, vdb-entry, x_refsource_BID)