NVD

Id
9175  
Name
CVE-2011-2383  
Description
Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.  
Reject
 
CVSS Version
2  
CVSS Score
4.3  
Severity
Medium  
CVSS Base Score
4.3  
CVSS Impact Subscore
2.9  
CVSS Exploit Subscore
8.6  
CVSS Vector
(AV:N/AC:M/Au:N/C:P/I:N/A:N)  
Pub Date
2017-01-07  
Published
2011-06-03  
Modified Date
2011-09-27  
Seq
2011-2383  

Actions

Related NVD References

Id NVD Id NVD No. Reference Actions
52475 9175 CVE-2011-2383 http://conference.hackinthebox.org/hitbsecconf2011ams/?page_id=1388  View
52476 9175 CVE-2011-2383 http://ju12.tistory.com/attachment/cfile4.uf@151FAB4C4DDC9E0002A6FE.ppt  View
52477 9175 CVE-2011-2383 http://news.cnet.com/8301-1009_3-20066419-83.html  View
52478 9175 CVE-2011-2383 oval:org.mitre.oval:def:12820  View
52479 9175 CVE-2011-2383 http://www.eweek.com/c/a/Security/IE-Flaw-Lets-Attackers-Steal-Cookies-Access-User-Accounts-402503/  View
52480 9175 CVE-2011-2383 http://www.informationweek.com/news/security/vulnerabilities/229700031  View
52481 9175 CVE-2011-2383 MS11-057  View
52482 9175 CVE-2011-2383 http://www.networkworld.com/community/node/74259  View
52483 9175 CVE-2011-2383 http://www.theregister.co.uk/2011/05/25/microsoft_internet_explorer_cookiejacking/  View
52484 9175 CVE-2011-2383 http://www.youtube.com/watch?v=V95CX-3JpK0  View
52485 9175 CVE-2011-2383 http://www.youtube.com/watch?v=VsSkcnIFCxM  View
52486 9175 CVE-2011-2383 https://sites.google.com/site/tentacoloviola/cookiejacking/Cookiejacking2011_final.ppt  View

Related JVN

Id Name Title Summary Cveinfo Name Cveinfo Id Nvdinfo Name Nvdinfo Id Cvssv2 Cvssv3 Jvnurl Published Date Last Updated Date Actions
31904 JVNDB-2011-002144 Microsoft Internet Explorer における Cookie を読まれる脆弱性 Microsoft Internet Explorer は、クロスゾーンのドラッグ＆ドロップ操作を適切に制限しないため、Cookie を読まれる脆弱性が存在します。 CVE-2011-2383 50290 CVE-2011-2383 9175 4.3 http://jvndb.jvn.jp/ja/contents/2011/JVNDB-2011-002144.html 2011-08-09 2011-08-26 View