vulnwire
7.5high

CVE-2003-0532in critical feed

Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow rem…

Published 23 y ago · modified 4 mo ago · JSON

CVSS
7.5
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
23.0%
percentile 98%
Public exploits
0
none known

Internet Explorer 5.01 SP3 through 6.0 SP1 does not properly determine object types that are returned by web servers, which could allow remote attackers to execute arbitrary code via an object tag with a data parameter to a malicious file hosted on a server that returns an unsafe Content-Type, aka the "Object Type" vulnerability.

Exploit prediction (EPSS)

22.96% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.07.5AV:N/AC:L/Au:N/C:P/I:P/A:P

References

  • kb.cert.org /vuls/id/865940 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2003/ms03-032 · vendor-advisory, x_refsource_MS, x_transferred
  • eeye.com /html/Research/Advisories/AD20030820.html · x_refsource_MISC, x_transferred
  • archives.neohapsis.com /archives/vulnwatch/2003-q3/0084.html · mailing-list, x_refsource_VULNWATCH, x_transferred
  • marc.info /?l=bugtraq&m=106149026621753&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.