CVE-2009-2064

Currently unrated

Key Information:

Vendor
Microsoft
Status
Internet Explorer
Pocket Ie
Vendor
CVE Published:
15 June 2009

Summary

Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

References

https://exchange.xforce.ibmcloud.com/vulnerabilities/51186
vdb-entryx_refsource_XF
http://www.securityfocus.com/bid/35403
vdb-entryx_refsource_BID
http://research.microsoft.com/pubs/79323/pbp-final-with-u...
x_refsource_MISC

Timeline

  • Vulnerability published

  • Vulnerability Reserved

Collectors

NVD DatabaseMitre Database
.