Microsoft Internet Explorer 6 SV 1 XHTML Comment User Confirmation Bypass

Low Nessus Network Monitor Plugin ID 2301


The remote host is vulnerable to a script injection attack.


The remote host is running Internet Explorer 6 SV1, the version that is part of Windows XP SP2. It is reported that the user confirmation asked before to load client-side JavaScript and ActiveX embedded in web pages can be trivially bypassed. An attacker may run malicious script on the remote host.


Upgrade or patch according to vendor recommendations.

Plugin Details

Severity: Low

ID: 2301

Family: Web Clients

Published: 2004/09/21

Modified: 2016/12/12

Dependencies: 1735, 8314

Risk Information

Risk Factor: Low


Base Score: 2.9

Temporal Score: 2.9

Vector: CVSS2#AV:A/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:U/RC:ND


Base Score: 3

Temporal Score: 3


Temporal Vector: CVSS3#E:H/RL:U/RC:X

Reference Information

CVE: CVE-2004-1686

BID: 11200