4.3 Medium
CVSS2
Access Vector
NETWORK
Access Complexity
MEDIUM
Authentication
NONE
Confidentiality Impact
NONE
Integrity Impact
PARTIAL
Availability Impact
NONE
AV:N/AC:M/Au:N/C:N/I:P/A:N
0.963 High
EPSS
Percentile
99.5%
Microsoft developer Dave Reed reported that certain BOM characters are stripped from JavaScript code before it is executed. This can lead to code, which would otherwise be treated as part of a quoted string, to be executed. The issue could potentially be used by an attacker to bypass or evade script filters and perform a cross-site scripting (XSS) attack. Chris Weber of Casaba Security independently reported the same issue, noting that the same parsing problem affected other attributes, such as the -moz-binding style property, that could also be used to perform XSS attacks.