XSS in Microsoft Internet Explorer
CVE-2015-0072
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Vulnerability class: XSS (Cross-Site Scripting)
Published · last modified .
CVSS v2 metric
CVSS v2 base score 4.3 (Medium). Vector: AV:N/AC:M/Au:N/C:N/I:P/A:N. This CVE predates CVSS v3 and has no v3 score from NVD.
EPSS exploit prediction
EPSS: 0.717 (99.4th percentile), scored .
High probability of exploitation in the next 30 days — patch promptly. 99th percentile — 99.4% of CVEs in the catalogue have a lower EPSS than this one. How to read EPSS.
EPSS over last 30 days · oldest: 0.717 · newest: 0.717 · change: 0.000
Affected products
- Microsoft Internet Explorer — versions 9, 10, 11
Weakness classification (CWE)
Public proof-of-concept exploits
References
- secunia.com/advisories/62658 (third-party-advisory)
- docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018 (vendor-advisory)
- www.securitytracker.com/id/1031888 (vdb-entry)
- community.websense.com/blogs/securitylabs/archive/2015/02/05/another-day-anothe…
- nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scriptin…
- www.pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerf…
- innerht.ml/blog/ie-uxss.html (Exploit)
- www.securityfocus.com/archive/1/534662/100/0/threaded (mailing-list)
- packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-… (Exploit)
- seclists.org/fulldisclosure/2015/Feb/0 (mailing-list)
Frequently asked questions
- What is CVE-2015-0072?
- CVE-2015-0072 is a vulnerability in Microsoft Internet Explorer, classified under Cross-site Scripting. Published 2015-02-07.
- Is CVE-2015-0072 known to be exploited?
- 8 public proof-of-concept repositories are indexed. Not currently listed in the CISA KEV catalog.