vulnwire
4.3med

CVE-2003-10253 exploits

Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the use…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
4.3
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
26.9%
percentile 98%
Public exploits
3
Exploit-DB

Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."

Exploit prediction (EPSS)

26.91% probability of exploitation in the next 30 days, higher than 98% of all scored CVEs.

Exploits and detections

  • EDB-23465 Opera Browser 6.0 6 - URI Display Obfuscation · remote · 2003-12-23
  • EDB-23423 Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (2) · remote · 2003-12-09
  • EDB-23422 Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (1) · remote · 2003-12-09

CVSS scores

Assigned byVersionScoreVector
NVD2.04.3AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-20 Improper Input Validation

References

  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A510 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A526 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • kb.cert.org /vuls/id/652278 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • securityfocus.com /archive/1/346948 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A513 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/13935 · vdb-entry, x_refsource_XF, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A491 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • us-cert.gov /cas/techalerts/TA04-033A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A512 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A490 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2004/ms04-004 · vendor-advisory, x_refsource_MS, x_transferred
  • zapthedingbat.com /security/ex01/vun1.htm · x_refsource_MISC, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A511 · vdb-entry, signature, x_refsource_OVAL, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.