CVE-2011-0096

MEDIUM

Microsoft Windows Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Title source: VulnCheck
Search associated code STIX 2.1 vulnerability STIX 2.1 with PoCs

Record summary

CVE-2011-0096 has a selected CVSS score of 6.1 (medium); EIP currently links 1 catalogued exploit.

Description

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

Description source: CVE List

Exploitation context

Known exploitation

VulnCheck KEV
Listed · Apr 12, 2011 · VulnCheck
Reported exploitation
Observed · VulnCheck

Available material

Catalogued exploits
1

CISA SSVC decision

ExploitationPoC
AutomatableNo
Technical impactPartial

CISA Coordinator · SSVC 2.0.3 · Evaluated Jan 21, 2025 · Source: CVE List

Affected products and versions

1
ProductSourceVersion range

Windows

Browse Microsoft / Windows
VulnCheckVersion data not supplied

Proofs of concept

1

Catalogued exploits

ExploitDBMicrosoft Internet Explorer - MHTML Protocol Handler Cross-Site ScriptingExploitDB exploitby 80vulNot analyzed1 file
ExploitDB
PoC details

References

Showing 12 of 16