CVE-2011-4689

Microsoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code.

CVSS v2.0 5.0 MEDIUM

5.0^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:L/Au:N/C:P/I:N/A:N

Exploitability : 10.0 / Impact : 2.9

Access Vector NETWORK

Access Complexity LOW

Authentication NONE

Confidentiality Impact PARTIAL

Integrity Impact NONE

Availability Impact NONE

References

Link	Resource
http://lcamtuf.coredump.cx/cachetime/	Exploit
http://secunia.com/advisories/47129	Vendor Advisory

Configurations

Configuration 1 (hide)

OR	cpe:2.3:a:microsoft:internet_explorer:6:::::::*
	cpe:2.3:a:microsoft:internet_explorer:7:::::::*
	cpe:2.3:a:microsoft:internet_explorer:8:::::::*
	cpe:2.3:a:microsoft:internet_explorer:9:::::::*

History

23 Jul 2021, 15:12

Type	Values Removed	Values Added
CPE	cpe:2.3:a:microsoft:ie:6:::::::* cpe:2.3:a:microsoft:ie:9:::::::* cpe:2.3:a:microsoft:ie:8:::::::* cpe:2.3:a:microsoft:ie:7:::::::*	cpe:2.3:a:microsoft:internet_explorer:6:::::::* cpe:2.3:a:microsoft:internet_explorer:9:::::::* cpe:2.3:a:microsoft:internet_explorer:8:::::::* cpe:2.3:a:microsoft:internet_explorer:7:::::::*

Information

Published : 2011-12-07 19:55

Updated : 2023-12-10 11:03

NVD link : CVE-2011-4689

Mitre link : CVE-2011-4689

CVE.ORG link : CVE-2011-4689

JSON object : View

Products Affected

microsoft

internet_explorer

CWE

CWE-264

Permissions, Privileges, and Access Controls

{"id": "CVE-2011-4689", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 5.0, "accessVector": "NETWORK", "vectorString": "AV:N/AC:L/Au:N/C:P/I:N/A:N", "authentication": "NONE", "integrityImpact": "NONE", "accessComplexity": "LOW", "availabilityImpact": "NONE", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 10.0, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": false}]}, "published": "2011-12-07T19:55:03.097", "references": [{"url": "http://lcamtuf.coredump.cx/cachetime/", "tags": ["Exploit"], "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/47129", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-264"}]}], "descriptions": [{"lang": "en", "value": "Microsoft Internet Explorer 6 through 9 does not prevent capture of data about the times of Same Origin Policy violations during IFRAME loading attempts, which makes it easier for remote attackers to determine whether a document exists in the browser cache via crafted JavaScript code."}, {"lang": "es", "value": "Microsoft Internet Explorer v6 hasta v9, no impide la captura de datos sobre los tiempos de violaci\u00f3n de \"Same Origin Policy\" durante los intentos de carga de IFRAME, lo que facilita a los atacantes remotos determinar si existe un documento en la cach\u00e9 del navegador a trav\u00e9s de c\u00f3digo JavaScript manipulado."}], "lastModified": "2021-07-23T15:12:53.913", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "693D3C1C-E3E4-49DB-9A13-44ADDFF82507"}, {"criteria": "cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A33FA7F-BB2A-4C66-B608-72997A2BD1DB"}, {"criteria": "cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A52E757F-9B41-43B4-9D67-3FEDACA71283"}, {"criteria": "cpe:2.3:a:microsoft:internet_explorer:9:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "C043EDDD-41BF-4718-BDCF-158BBBDB6360"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}