Microsoft Internet Explorer 6 SV 1 XHTML Comment User Confirmation Bypass

Low Nessus Network Monitor Plugin ID 2301

Synopsis

The remote host is vulnerable to a script injection attack.

Description

The remote host is running Internet Explorer 6 SV1, the version that is part of Windows XP SP2. It is reported that the user confirmation asked before to load client-side JavaScript and ActiveX embedded in web pages can be trivially bypassed. An attacker may run malicious script on the remote host.

Solution

Upgrade or patch according to vendor recommendations.

Plugin Details

Severity: Low

ID: 2301

Family: Web Clients

Published: 2004/09/21

Modified: 2016/12/12

Dependencies: 1735, 8314

Risk Information

Risk Factor: Low

CVSSv2

Base Score: 2.9

Temporal Score: 2.9

Vector: CVSS2#AV:A/AC:M/Au:N/C:N/I:P/A:N

Temporal Vector: CVSS2#E:H/RL:U/RC:ND

CVSSv3

Base Score: 3

Temporal Score: 3

Vector: CVSS3#AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS3#E:H/RL:U/RC:X

Reference Information

CVE: CVE-2004-1686

BID: 11200