Vulnerability Monitor

The vendors, products, and vulnerabilities you care about

CVE-2005-4827

Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name), which is supported by some proxy servers that convert tabs to spaces. NOTE: this issue can be leveraged to conduct referer spoofing, HTTP Request Smuggling, and other attacks.

Published

2005-12-31T05:00:00.000

Last Modified

2025-04-03T01:03:51.193

Status

Deferred

Source

[email protected]

Severity

CVSSv2: 7.5 (HIGH)

CVSSv2 Vector

AV:N/AC:L/Au:N/C:P/I:P/A:P

  • Access Vector: NETWORK
  • Access Complexity: LOW
  • Authentication: NONE
  • Confidentiality Impact: PARTIAL
  • Integrity Impact: PARTIAL
  • Availability Impact: PARTIAL
Exploitability Score

10.0

Impact Score

6.4

Weaknesses
  • Type: Primary
    NVD-CWE-Other
Affected Vendors & Products
Type Vendor Product Version/Range Vulnerable?
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft ie 6.0 Yes
Application microsoft internet_explorer 6 Yes
Application microsoft internet_explorer 6.0 Yes
Application microsoft internet_explorer 6.0.2600 Yes
Application microsoft internet_explorer 6.0.2800 Yes
Application microsoft internet_explorer 6.0.2800.1106 Yes
Application microsoft internet_explorer 6.0.2900.2180 Yes
Hardware canon network_camera_server_vb101 * Yes
References