NVD

Id
9174  
Name
CVE-2011-2382  
Description
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2011-06-03  
Modified Date
2011-06-14  
Seq
2011-2382  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
52465 9174 CVE-2011-2382 http://conference.hackinthebox.org/hitbsecconf2011ams/?page_id=1388  View
52466 9174 CVE-2011-2382 http://ju12.tistory.com/attachment/cfile4.uf@151FAB4C4DDC9E0002A6FE.ppt  View
52467 9174 CVE-2011-2382 http://news.cnet.com/8301-1009_3-20066419-83.html  View
52468 9174 CVE-2011-2382 http://www.eweek.com/c/a/Security/IE-Flaw-Lets-Attackers-Steal-Cookies-Access-User-Accounts-402503/  View
52469 9174 CVE-2011-2382 http://www.informationweek.com/news/security/vulnerabilities/229700031  View
52470 9174 CVE-2011-2382 http://www.networkworld.com/community/node/74259  View
52471 9174 CVE-2011-2382 http://www.theregister.co.uk/2011/05/25/microsoft_internet_explorer_cookiejacking/  View
52472 9174 CVE-2011-2382 http://www.youtube.com/watch?v=V95CX-3JpK0  View
52473 9174 CVE-2011-2382 http://www.youtube.com/watch?v=VsSkcnIFCxM  View
52474 9174 CVE-2011-2382 https://sites.google.com/site/tentacoloviola/cookiejacking/Cookiejacking2011_final.ppt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
34450 JVNDB-2011-004692 Microsoft Internet Explorer 8 および Internet Explorer 9 におけるクッキーファイルを読まれる脆弱性 Microsoft Internet Explorer 8 および Internet Explorer 9 は、クロスゾーンのドラッグ & ドロップ操作を適切に制限しないため、クッキーファイルを読まれる脆弱性が存在します。 CVE-2011-2382 50289 CVE-2011-2382 9174 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-004692.html 2011-06-03 2012-03-27 View