9.3

CVE-2008-3472

Microsoft Internet Explorer 6 and 7 does not properly determine the domain or security zone of origin of web script, which allows remote attackers to bypass the intended cross-domain security policy, and execute arbitrary code or obtain sensitive information, via a crafted HTML document, aka "HTML Element Cross-Domain Vulnerability."

Data is provided by the National Vulnerability Database (NVD)
Microsoft ≫ Internet Explorer Version5.01 Updatesp4
   Microsoft ≫ Windows 2000 Updatesp4
Microsoft ≫ Internet Explorer Version6
   Microsoft ≫ Windows Server 2003 Updatesp1
   Microsoft ≫ Windows Server 2003 Updatesp1 Editionitanium
   Microsoft ≫ Windows Server 2003 Updatesp1 Editionx64
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Xp Updategold Editionprofessional_x64
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp2 Editionprofessional_x64
   Microsoft ≫ Windows Xp Updatesp3
Microsoft ≫ Internet Explorer Version6 Updatesp1
   Microsoft ≫ Windows 2000 Updatesp4
Microsoft ≫ Internet Explorer Version7
   Microsoft ≫ Windows Server 2003 Updatesp1
   Microsoft ≫ Windows Server 2003 Updatesp1 Editionitanium
   Microsoft ≫ Windows Server 2003 Updatesp1 Editionx64
   Microsoft ≫ Windows Server 2003 Updatesp2
   Microsoft ≫ Windows Server 2008 Editionitanium
   Microsoft ≫ Windows Server 2008 Editionx32
   Microsoft ≫ Windows Server 2008 Editionx64
   Microsoft ≫ Windows Vista Updategold
   Microsoft ≫ Windows Vista Updategold Editionx64
   Microsoft ≫ Windows Vista Updatesp1
   Microsoft ≫ Windows Xp Updategold Editionprofessional_x64
   Microsoft ≫ Windows Xp Updatesp2
   Microsoft ≫ Windows Xp Updatesp2 Editionprofessional_x64
   Microsoft ≫ Windows Xp Updatesp3
Zu dieser CVE wurde keine CISA KEV oder CERT.AT-Warnung gefunden.
EPSS Metriken
Type Source Score Percentile
EPSS FIRST.org 46.05% 0.976
CVSS Metriken
Source Base Score Exploit Score Impact Score Vector string
nvd@nist.gov 9.3 8.6 10
AV:N/AC:M/Au:N/C:C/I:C/A:C