CVE-2010-0488

high-risk

Published 2010-03-31

Microsoft Internet Explorer 5.01 SP4, 6, 6 SP1, and 7 does not properly handle unspecified "encoding strings," which allows remote attackers to bypass the Same Origin Policy and obtain sensitive information via a crafted web site, aka "Post Encoding Information Disclosure Vulnerability."

Do I need to act?

15.5% chance of exploitation in next 30 days

EPSS score — higher than 84% of all CVEs

Not on CISA KEV list

No confirmed active exploitation reported to CISA

Patch status unknown

Check vendor advisories for fix availability and mitigation guidance

CVSS 6.5/10 Medium

NETWORK / LOW complexity

Affected Products (20)

Windows 2003 Server

Windows Xp

Windows Server 2008

Windows Vista

Windows 2003 Server

Internet Explorer

Windows Server 2003

Windows Xp

Windows Server 2008

Windows Vista

Internet Explorer

Affected Vendors

Microsoft

References (18)

http://jvn.jp/en/jp/JVN49467403/index.html

http://jvndb.jvn.jp/en/contents/2010/JVNDB-2010-000011.html

http://securitytracker.com/id?1023773

Patch http://www.securityfocus.com/bid/39028

US Government Resource http://www.us-cert.gov/cas/techalerts/TA10-068A.html

US Government Resource http://www.us-cert.gov/cas/techalerts/TA10-089A.html

Patch http://www.vupen.com/english/advisories/2010/0744

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2010/ms10-01...

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3...