CVE-2011-0096 json
The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gol…
published 2011-01-31 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-0122
- cvss
- 6.1
- version 3.1, CNA
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 47.1%
- EPSS 47.1% chance of exploitation in 30 days, percentile 98%
- public exploits
- 1
- Exploit-DB
Summary
The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."
Timeline
- First public exploit (EDB-16071)
- Published
CISA SSVC
- Exploitation
- Proof of concept is public
- Automatable
- no
- Technical impact
- partial
- Assessed
- 21 mo ago
Exploit prediction
47.10% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-09).
Exploits and checks
- EDB-16071 Microsoft Internet Explorer - MHTML Protocol Handler Cross-Site Scripting local, 2011-01-29
- 80vul.com http://www.80vul.com/webzine_0x05/0x05%20IE%E4%B8%8BMHTML%E5%8D%8F%E8%AE%AE%E5%B8%A6%E6%9D%A5%E7%9A%84%E8%B7%A8%E5%9F%9F%E5%8D%B1%E5%AE%B3.html referenced PoC, tagged "exploit" by a source, unverified
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| CISA ADP | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| CNA | 3.1 | 6.1 | CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N |
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:N/I:P/A:N |
Classification
- Weakness
-
- CWE-79 Improper Neutralization of Input During Web Page Generation
References
-
exploit-db.com
/exploits/16071
exploit
-
80vul.com
/webzine_0x05/0x05%20IE%E4%B8%8BMHTML%E5%8D%8F%E8%AE%AE%E5%B8%A6%E6%9D%A5%E7%9A%84%E8%B7%A8%E5%9F%9F%E5%8D%B1%
exploit
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2011/ms11-026
vendor-advisory
-
microsoft.com
/technet/security/advisory/2501696.mspx
vendor-advisory
-
secunia.com
/advisories/43093
third-party-advisory, vendor-advisory
-
vupen.com
/english/advisories/2011/0242
vdb-entry, vendor-advisory
-
kb.cert.org
/vuls/id/326549
third-party-advisory, us-government-resource
-
us-cert.gov
/cas/techalerts/TA11-102A.html
third-party-advisory, us-government-resource
-
securityfocus.com
/bid/46055
vdb-entry
- blogs.technet.com /b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx
-
securitytracker.com
/id?1025003
vdb-entry
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6956
vdb-entry, signature
- blogs.technet.com /b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx
-
osvdb.org
/70693
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/65000
vdb-entry
Sources
- CVE List CVE-2011-0096
- NVD CVE-2011-0096
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.