CVE-2003-1025
Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 26.9%, higher than 98% of all known CVEs. Patch or mitigate before the next change window.
Description
Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 26.91% probability · 98th percentile
- CISA KEV
- Not listed
- Weakness
- CWE-20
- Affected
- microsoft/internet explorer
- Source
- cve@mitre.org
References
- http://www.kb.cert.org/vuls/id/652278Third Party Advisory, US Government Resource
- http://www.securityfocus.com/archive/1/346948Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA04-033A.htmlUS Government Resource
- http://www.zapthedingbat.com/security/ex01/vun1.htmExploit, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-004
- https://exchange.xforce.ibmcloud.com/vulnerabilities/13935
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A490
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A491
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A510
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A511
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A512
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A513
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A526
- http://www.kb.cert.org/vuls/id/652278Third Party Advisory, US Government Resource
- http://www.securityfocus.com/archive/1/346948Vendor Advisory
- http://www.us-cert.gov/cas/techalerts/TA04-033A.htmlUS Government Resource
- http://www.zapthedingbat.com/security/ex01/vun1.htmExploit, Vendor Advisory
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-004
- https://exchange.xforce.ibmcloud.com/vulnerabilities/13935
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A490
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A491
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A510
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A511
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A512
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A513
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A526
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.