CVE-2009-3003
Last modified
CVE-2009-3003 is a vulnerability of currently unknown severity. Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.. EPSS estimates a 10.60% chance of exploitation in the next 30 days.
Description
Microsoft Internet Explorer 6 through 8 allows remote attackers to spoof the address bar, via window.open with a relative URI, to show an arbitrary URL on the web site visited by the victim, as demonstrated by a visit to an attacker-controlled web page, which triggers a spoofed login form for the site containing that page.
Metrics
Affected Software
| Vendor | Product | Versions |
|---|---|---|
| Microsoft | Internet Explorer | 6 |
| Microsoft | Internet Explorer | 7 |
| Microsoft | Internet Explorer | 8 |
References
- http://secunia.com/advisories/36334Vendor Advisory
- http://secunia.com/advisories/36334Vendor Advisory
Timeline
- Published
- Last Modified
- Status
- Modified
Frequently Asked Questions
What is CVE-2009-3003?
How severe is CVE-2009-3003?
How do I fix CVE-2009-3003?
How Strix Helps
- How Strix found a critical auth bypass in etcdStrix autonomously discovered a critical authentication bypass in etcd, later designated CVE-2026-33413.
- Autonomous PentestingAI agents that find and validate exploitable vulnerabilities like this one across your applications.
- PR ReviewsPentest every pull request so vulnerable code is caught before it ships to production.
- AI Penetration TestingHow AI-driven penetration testing continuously covers your attack surface.
Related CVEs from 2009
- CVE-2009-2997Heap-based buffer overflow in Adobe Reader and Acrobat 7.x b…
- CVE-2009-2998Adobe Reader and Acrobat 7.x before 7.1.4, 8.x before 8.1.7,…
- CVE-2009-2999The com.android.phone process in Android 1.5 CRBxx allows re…
- CVE-2009-3000The sockfs module in the kernel in Sun Solaris 10 and OpenSo…
- CVE-2009-3001The llc_ui_getname function in net/llc/af_llc.c in the Linux…
- CVE-2009-3002The Linux kernel before 2.6.31-rc7 does not initialize certa…
- CVE-2009-3004Avant Browser 11.7 Builds 35 and 36 allows remote attackers …
- CVE-2009-3005Lunascape 5.1.3 and 5.1.4 allows remote attackers to spoof t…
- CVE-2009-3006Maxthon Browser 2.5.3.80 UNICODE allows remote attackers to …
- CVE-2009-3007Mozilla Firefox 3.5.1 and SeaMonkey 1.1.17, and Flock 2.5.1,…
- CVE-2009-3008K-Meleon 1.5.3 allows context-dependent attackers to spoof t…
- CVE-2009-3009Cross-site scripting (XSS) vulnerability in Ruby on Rails 2.…
Are you affected by CVE-2009-3003?
Run a free Strix scan to check your systems for this vulnerability.
Scan your code nowSource: NVD / NIST