Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone…
Priority LOW 39CWE-20Published · Updated
Key facts
- Attack vector
- Network
- Privileges required
- None
- User interaction
- — Not recorded in CVSS 2.0
- Attack complexity
- Medium
- Impact type
- —
- Confidentiality · integrity · availability
- Partial · None · None
- Fix status
- No fix listed
Attack profile from CVSS 2.0 · NVD. Fix status from CNA.
Summary
Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.
Why it matters now
EPSS 0.20847 97th percentileScored 2026-11-07
Fix No fix listed No fixed version in the sources yet
SSVC decision points
Not available: CISA has not published SSVC decision points for this record.
Affected products
| Vendor | Product | Affected versions | Fixed in | Status | Source |
|---|---|---|---|---|---|
| — | — | all versions | — | No fix listed | CNA |
- — Vendor— Affected all versions Fixed in — No fix listed CNA
CPE configurations NVD · 8
| CPE | Versions | Role | Vendor |
|---|---|---|---|
| cpe:2.3:a:microsoft:ie:9:beta:*:*:*:*:*:* | 9 beta | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:* | up to 9 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:3.0:*:*:*:*:*:*:* | 3.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:4.0:*:*:*:*:*:*:* | 4.0 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:5:*:*:*:*:*:*:* | 5 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:* | 6 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:* | 7 | Vulnerable | Microsoft |
| cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:* | 8 | Vulnerable | Microsoft |
- cpe:2.3:a:microsoft:ie:9:beta:*:*:*:*:*:* Versions 9 beta Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:*:*:*:*:*:*:*:* Versions up to 9 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:3.0:*:*:*:*:*:*:* Versions 3.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:4.0:*:*:*:*:*:*:* Versions 4.0 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:5:*:*:*:*:*:*:* Versions 5 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:* Versions 6 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:* Versions 7 Vulnerable ·Microsoft
- cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:* Versions 8 Vulnerable ·Microsoft
Remediation
No fixed version listed by the sources yet.
Timeline
- 2026-10-02 Threatist record created from CVE-2011-2383
- 2026-10-03 Alias added: GHSA-9q5h-jvgh-x2h7
References
Advisory 1
Other 11
- http://www.informationweek.com/news/security/vulnerabilities/229700031
- http://conference.hackinthebox.org/hitbsecconf2011ams/?page_id=1388
- http://news.cnet.com/8301-1009_3-20066419-83.html
- http://www.eweek.com/c/a/Security/IE-Flaw-Lets-Attackers-Steal-Cookies-Access-User-Accounts-402503/
- http://www.theregister.co.uk/2011/05/25/microsoft_internet_explorer_cookiejacking/
- oval:org.mitre.oval:def:12820
- http://www.youtube.com/watch?v=VsSkcnIFCxM
- http://ju12.tistory.com/attachment/cfile4.uf%40151FAB4C4DDC9E0002A6FE.ppt
- http://www.networkworld.com/community/node/74259
- http://www.youtube.com/watch?v=V95CX-3JpK0
- https://sites.google.com/site/tentacoloviola/cookiejacking/Cookiejacking2011_final.ppt
More Microsoft Ie vulnerabilities
- TI-2004-00947 Heap-based buffer overflow in Internet Explorer 6 allows remote attackers to execute… CVSS 2.0HIGH 10.0
- TI-2004-00183 Stack-based buffer overflow in the Task Scheduler for Windows 2000 and XP, and Internet… CVSS 2.0HIGH 10.0
- TI-2007-00210 The wininet.dll FTP client code in Microsoft Internet Explorer 5.01 and 6 might allow… CVSS 2.0HIGH 10.0
- TI-2006-01313 Microsoft Internet Explorer 6 and 7 Beta 2 allows remote attackers to cause a denial of… CVSS 2.0HIGH 9.3
- TI-2006-01146 Microsoft Internet Explorer 5.01 through 6 allows remote attackers to execute arbitrary… CVSS 2.0HIGH 10.0
- TI-2006-03617 Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote… CVSS 3.1HIGH 8.8
Sources
- CVE-2011-2383 · CVE Program
- CVE-2011-2383 · NVD
- FIRST EPSS
- GHSA-9q5h-jvgh-x2h7 · GitHub Advisory Database · CC BY 4.0
This product uses the NVD API but is not endorsed or certified by the NVD. Sources and licences