CVE-2009-2350

Microsoft Internet Explorer 6.0.2900.2180 - XSS

Title source: llm

Description

Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312.

Exploits (1)

exploitdb WRITEUP VERIFIED

by MustLive · textremotewindows

https://www.exploit-db.com/exploits/33063

View Code ZIP pw:eip

References (5)

[Exploit] http://websecurity.com.ua/3275/

[Various Sources] http://websecurity.com.ua/3386/

[Exploit] http://www.securityfocus.com/bid/35570

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/504718/100/0/threaded

[Third Party Advisory, VDB Entry] http://www.securityfocus.com/archive/1/504723/100/0/threaded

Scores

EPSS 0.1329

EPSS Percentile 94.0%

Classification

CWE

CWE-79

Status draft

Affected Products (1)

microsoft/internet_explorer

Timeline

Published Jul 07, 2009

Tracked Since Feb 18, 2026