CVE-2011-0096

CVSS 6.1 MEDIUMEPSS 46.8%CWE-79

Vexday Risk Score

45Atención

Decisión SSVC (CISA)

Attend

PoC disponible → seguir de cerca

CVSS 6.1EPSS 46.8%KEV nãoPoC públicaNuclei —Metasploit —Patch referenciado

Ciclo de vida

29 ene 2011PoC pública

31 ene 2011Publicada en NVD

Recomendación: Planificar corrección próxima — ya existe PoC pública.

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Productos afectados

n/a · n/a

PoCs públicas encontradas — 2

cve_referencewww.exploit-db.com/exploits/16071no verificado exploitdbwww.exploit-db.com/exploits/16071no verificado

⚠ Recursos públicos, para evaluar la exposición de sistemas que controlas o estás autorizado a probar. Prueba solo con autorización.

¿Quieres saber si tu infraestructura está expuesta a esto?

Hablar con TrueHacking →

Referencias

http://blogs.technet.com/b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx http://blogs.technet.com/b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx http://osvdb.org/70693 https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-026 http://secunia.com/advisories/43093 https://exchange.xforce.ibmcloud.com/vulnerabilities/65000 https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6956 http://www.80vul.com/webzine_0x05/0x05%20IE%E4%B8%8BMHTML%E5%8D%8F%E8%AE%AE%E5%B8%A6%E6%9D%A5%E7%9A%84%E8%B7%A8%E5%9F%9F%E5%8D%B1%E5%AE%B3.html http://www.exploit-db.com/exploits/16071 http://www.kb.cert.org/vuls/id/326549 http://www.microsoft.com/technet/security/advisory/2501696.mspx http://www.securityfocus.com/bid/46055