CVE-2004-0869: Medium severity Microsoft ie vulnerability
Internet Explorer does not prevent cookies that are sent over an insecure channel (HTTP) from also being sent over a secure channel (HTTPS/SSL) in the same domain, which could allow remote attackers to steal cookies and conduct unauthorized activities, aka "Cross Security Boundary Cookie Injection."
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2004-0869?
CVE-2004-0869 is considered a moderate severity vulnerability due to the potential for attackers to steal cookies.
How do I fix CVE-2004-0869?
To mitigate CVE-2004-0869, ensure your web applications enforce secure cookie attributes and use HTTPS for all page content.
Who is affected by CVE-2004-0869?
Users of Microsoft Internet Explorer 6 on Windows Server 2003 SP1 are affected by CVE-2004-0869.
What can attackers achieve with CVE-2004-0869?
Attackers can potentially steal session cookies and impersonate users, leading to unauthorized access.
Is there a workaround for CVE-2004-0869?
A workaround for CVE-2004-0869 is to use security features in modern web browsers that restrict cookie sharing across HTTP and HTTPS.