CVE-2011-2382 json
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which…
published 2011-06-03 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-2371
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 19.3%
- EPSS 19.3% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.
Exploit prediction
19.30% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
- informationweek.com /news/security/vulnerabilities/229700031
- conference.hackinthebox.org /hitbsecconf2011ams/?page_id=1388
- news.cnet.com /8301-1009_3-20066419-83.html
- eweek.com /c/a/Security/IE-Flaw-Lets-Attackers-Steal-Cookies-Access-User-Accounts-402503/
- theregister.co.uk /2011/05/25/microsoft_internet_explorer_cookiejacking/
- youtube.com /watch?v=VsSkcnIFCxM
- ju12.tistory.com /attachment/cfile4.uf%40151FAB4C4DDC9E0002A6FE.ppt
- networkworld.com /community/node/74259
- youtube.com /watch?v=V95CX-3JpK0
- sites.google.com /site/tentacoloviola/cookiejacking/Cookiejacking2011_final.ppt
Sources
- CVE List CVE-2011-2382
- NVD CVE-2011-2382
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.