CVE-2004-2383: Medium severity Microsoft ie vulnerability

Published Dec 31, 2004

Updated

Microsoft Internet Explorer 5.0 through 6.0 allows remote attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains via an HTML document with Javascript that is outside a frameset that includes the target domain, then forcing the frameset to maintain focus. NOTE: the discloser claimed that the vendor does not categorize this as a vulnerability, but it can be used in a spoofing scenario; the discloser provides alternate scenarios. Spoofing scenarios are currently included in CVE.

Affected Software

5 affected components

Microsoft ie=6.0-sp1

Microsoft Internet Explorer=5.5

Microsoft Internet Explorer=5.5-sp1

Microsoft Internet Explorer=5.5-sp2

Microsoft Internet Explorer=6.0

Event History

Dec 31, 2004

CVE Published

05:00 AM

Aug 16, 2005

CVE Published

via MITRE·08:00 AM

Data Sourced

via MITRE·08:00 AM

Description

Frequently Asked Questions

What is the severity of CVE-2004-2383?

CVE-2004-2383 has been classified as a moderate severity vulnerability.

How do I fix CVE-2004-2383?

To fix CVE-2004-2383, users should upgrade to a newer version of Microsoft Internet Explorer that is not affected.

What software is affected by CVE-2004-2383?

CVE-2004-2383 affects Microsoft Internet Explorer versions 5.0 to 6.0, including specific service packs.

What type of attack is possible with CVE-2004-2383?

CVE-2004-2383 allows attackers to bypass cross-frame scripting restrictions and capture keyboard events from other domains.

When was CVE-2004-2383 disclosed?

CVE-2004-2383 was disclosed in 2004.