CVEvulnerability
CVE-2009-2064
6.8 MEDIUM
Official page ↗
- Status
- Modified
- Published
- 2009-06-15
- Last modified
- 2026-06-16
- Assigner
- [email protected]
- CVSS 2.0 ([email protected])
- 6.8 MEDIUM — AV:N/AC:M/Au:N/C:P/I:P/A:P
- Weaknesses
- CWE-287
Description
Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
Affected configurations
• microsoft internet explorer (<= 8)
• microsoft internet explorer 5
• microsoft internet explorer 5.01
• microsoft internet explorer 6
• microsoft internet explorer 7
• microsoft internet explorer 7.0.5730
• microsoft internet explorer 8
• microsoft internet explorer 8.0b
• microsoft pocket ie 1.0
• microsoft pocket ie 1.1
• microsoft pocket ie 2.0
• microsoft pocket ie 3.0
• microsoft pocket ie 4.0
• microsoft pocket ie 2002
• microsoft pocket ie 2003
Related
Weakness · CWE (1)
- CWE-287 Improper Authentication weakness
References
- http://research.microsoft.com/apps/pubs/default.aspx?id=79323 research.microsoft.com
- http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf research.microsoft.com
- http://www.securityfocus.com/bid/35403 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51186 exchange.xforce.ibmcloud.com
- http://research.microsoft.com/apps/pubs/default.aspx?id=79323 research.microsoft.com
- http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf research.microsoft.com
- http://www.securityfocus.com/bid/35403 www.securityfocus.com
- https://exchange.xforce.ibmcloud.com/vulnerabilities/51186 exchange.xforce.ibmcloud.com