Detections
Analytics

Microsoft Internet Explorer 6 SV 1 XHTML Comment User Confirmation Bypass

low Nessus Network Monitor Plugin ID 2301

Synopsis

The remote host is vulnerable to a script injection attack.

Description

The remote host is running Internet Explorer 6 SV1, the version that is part of Windows XP SP2. It is reported that the user confirmation asked before to load client-side JavaScript and ActiveX embedded in web pages can be trivially bypassed. An attacker may run malicious script on the remote host.

Solution

Upgrade or patch according to vendor recommendations.

Plugin Details

Severity: Low

ID: 2301

Family: Web Clients

Published: 9/21/2004

Updated: 9/16/2018

Risk Information

VPR

Risk Factor: Low

Score: 3.4

CVSS v2

Risk Factor: Low

Base Score: 2.9

Temporal Score: 2.9

Vector: CVSS2#AV:A/AC:M/Au:N/C:N/I:P/A:N

CVSS v3

Risk Factor: Low

Base Score: 3.1

Temporal Score: 3.1

Vector: CVSS:3.0/AV:A/AC:H/PR:N/UI:N/S:U/C:N/I:L/A:N

Temporal Vector: CVSS:3.0/E:H/RL:U/RC:X

Vulnerability Information

CPE: cpe:/a:microsoft:ie

Reference Information

CVE: CVE-2004-1686

BID: 11200