CVE-2011-2383: Input Validation
Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2011-2383?
CVE-2011-2383 is considered a moderate severity vulnerability due to the potential for information disclosure.
How do I fix CVE-2011-2383?
To fix CVE-2011-2383, users should upgrade to a newer version of Microsoft Internet Explorer that does not have this vulnerability.
Which versions of Internet Explorer are affected by CVE-2011-2383?
CVE-2011-2383 affects Microsoft Internet Explorer versions 3.0 through 9.0.
What type of attack is associated with CVE-2011-2383?
CVE-2011-2383 is associated with user-assisted remote attacks that exploit cross-zone drag-and-drop actions.
Can CVE-2011-2383 lead to cookie theft?
Yes, CVE-2011-2383 can allow attackers to read cookie files if exploited correctly.