vulnwire
10.0crit

CVE-2003-1027in critical feed

Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windo…

Published 22 y ago · modified 4 mo ago · JSON

CVSS
10.0
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
38.1%
percentile 99%
Public exploits
0
none known

Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."

Exploit prediction (EPSS)

38.05% probability of exploitation in the next 30 days, higher than 99% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.010.0AV:N/AC:L/Au:N/C:C/I:C/A:C

References

  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A527 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • kb.cert.org /vuls/id/413886 · third-party-advisory, x_refsource_CERT-VN, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A629 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A531 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • safecenter.net /UMBRELLAWEBV4/HijackClickV2 · x_refsource_MISC, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A530 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • marc.info /?l=bugtraq&m=107038202225587&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • us-cert.gov /cas/techalerts/TA04-033A.html · third-party-advisory, x_refsource_CERT, x_transferred
  • docs.microsoft.com /en-us/security-updates/securitybulletins/2004/ms04-004 · vendor-advisory, x_refsource_MS, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A532 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A534 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • marc.info /?l=bugtraq&m=106979479719446&w=2 · mailing-list, x_refsource_BUGTRAQ, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/13844 · vdb-entry, x_refsource_XF, x_transferred
  • oval.cisecurity.org /repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A529 · vdb-entry, signature, x_refsource_OVAL, x_transferred
  • securitytracker.com /id?1006036 · vdb-entry, x_refsource_SECTRACK, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.