CVE-2011-2383 json
Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote at…
published 2011-06-03 15 y ago modified 2026-06-16 4 mo ago also EUVD-2011-2372
- cvss
- 4.3
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 20.8%
- EPSS 20.8% chance of exploitation in 30 days, percentile 97%
- public exploits
- 0
- none known
Summary
Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.
Exploit prediction
20.85% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-09).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.3 | AV:N/AC:M/Au:N/C:P/I:N/A:N |
Classification
- Weakness
-
- CWE-20 Improper Input Validation
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2011/ms11-057
vendor-advisory
- informationweek.com /news/security/vulnerabilities/229700031
- conference.hackinthebox.org /hitbsecconf2011ams/?page_id=1388
- news.cnet.com /8301-1009_3-20066419-83.html
- eweek.com /c/a/Security/IE-Flaw-Lets-Attackers-Steal-Cookies-Access-User-Accounts-402503/
- theregister.co.uk /2011/05/25/microsoft_internet_explorer_cookiejacking/
-
oval.cisecurity.org
/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A12820
vdb-entry, signature
- youtube.com /watch?v=VsSkcnIFCxM
- ju12.tistory.com /attachment/cfile4.uf%40151FAB4C4DDC9E0002A6FE.ppt
- networkworld.com /community/node/74259
- youtube.com /watch?v=V95CX-3JpK0
- sites.google.com /site/tentacoloviola/cookiejacking/Cookiejacking2011_final.ppt
Sources
- CVE List CVE-2011-2383
- NVD CVE-2011-2383
Fencer Intel keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.