CVE-2009-4074: XSS
First published: Wed Nov 25 2009(Updated: )
The XSS Filter in Microsoft Internet Explorer 8 allows remote attackers to leverage the "response-changing mechanism" to conduct cross-site scripting (XSS) attacks against web sites that have no inherent XSS vulnerabilities, related to the details of output encoding and improper modification of an HTML attribute, aka "XSS Filter Script Handling Vulnerability."
Credit: cve@mitre.org
| Affected Software | Affected Version | How to fix |
|---|---|---|
| Internet Explorer | =8 |
Never miss a vulnerability like this again
Sign up to SecAlerts for real-time vulnerability data matched to your software, aggregated from hundreds of sources.
Reference Links
- http://www.owasp.org/images/5/50/OWASP-Italy_Day_IV_Maone.pdf
- http://hackademix.net/2009/11/21/ies-xss-filter-creates-xss-vulnerabilities/
- http://www.theregister.co.uk/2009/11/20/internet_explorer_security_flaw/
- http://www.securityfocus.com/bid/37135
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A7715
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-002
Frequently Asked Questions
What is the severity of CVE-2009-4074?
CVE-2009-4074 has a medium severity rating due to its ability to facilitate cross-site scripting attacks.
How do I fix CVE-2009-4074?
To fix CVE-2009-4074, users should update Microsoft Internet Explorer to the latest version or apply any available security patches.
What type of attacks does CVE-2009-4074 enable?
CVE-2009-4074 enables remote attackers to conduct cross-site scripting (XSS) attacks against affected websites.
Which software is affected by CVE-2009-4074?
CVE-2009-4074 affects Microsoft Internet Explorer 8 specifically.
Can CVE-2009-4074 impact websites without inherent XSS vulnerabilities?
Yes, CVE-2009-4074 can impact websites that have no inherent XSS vulnerabilities by exploiting the XSS Filter's response-changing mechanism.
- agent/type
- agent/references
- agent/softwarecombine
- collector/mitre-cve
- source/MITRE
- agent/weakness
- agent/severity
- agent/last-modified-date
- agent/author
- agent/first-publish-date
- agent/event
- agent/description
- agent/source
- agent/tags
- collector/nvd-historical
- agent/software-canonical-lookup-request
- collector/nvd-index
- vendor/microsoft
- canonical/internet explorer
- version/internet explorer/8