Security Bypass in Microsoft Internet Explorer 8 and Other Versions

CVE-2009-2064

Summary

A vulnerability exists in Microsoft Internet Explorer 8, where the browser only detects HTTP content in HTTPS web pages when the top-level frame is secured via HTTPS. This flaw can be exploited by man-in-the-middle attackers who can manipulate an HTTP page to add an HTTPS iframe that references an external script file hosted on an HTTP site. This can lead to the execution of arbitrary web scripts in the context of HTTPS sites, compromising user data and security.

References