CVEvulnerability

CVE-2011-2383

4.3 MEDIUM Published 2011-06-03 Modified 2026-06-16 Official page ↗
Status
Modified
Published
2011-06-03
Last modified
2026-06-16
Assigner
[email protected]
CVSS 2.0 ([email protected])
4.3 MEDIUM — AV:N/AC:M/Au:N/C:P/I:N/A:N
Weaknesses
CWE-20

Description

Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.

Affected configurations

• microsoft ie 9 • microsoft internet explorer (<= 9) • microsoft internet explorer 3.0 • microsoft internet explorer 4.0 • microsoft internet explorer 5 • microsoft internet explorer 6 • microsoft internet explorer 7 • microsoft internet explorer 8

Related

Weakness · CWE (1)

  • CWE-20 Improper Input Validation weakness

References