CVE-2007-3164
Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow…
Does this matter?
Lower severity and a low EPSS score (9.85%). Track it; it rarely justifies an emergency change on its own.
Description
Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels, as demonstrated by displaying xn--theshmogroup-bgk.com only in the status bar.
- CVSS 2.0
- 5.8 MEDIUMAV:N/AC:M/Au:N/C:P/I:P/A:N
- EPSS
- 9.85% probability · 95th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/internet explorer
- Source
- cve@mitre.org
References
- http://ha.ckers.org/blog/20070608/cross-domain-basic-auth-phishing-tactics/
- http://osvdb.org/36142
- http://secunia.com/advisories/25663
- http://www.bitsploit.de/archives/428-Cross-Domain-Basic-Auth-Phishing-Tactics.html
- http://www.securityfocus.com/bid/24483
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34867
- http://ha.ckers.org/blog/20070608/cross-domain-basic-auth-phishing-tactics/
- http://osvdb.org/36142
- http://secunia.com/advisories/25663
- http://www.bitsploit.de/archives/428-Cross-Domain-Basic-Auth-Phishing-Tactics.html
- http://www.securityfocus.com/bid/24483
- https://exchange.xforce.ibmcloud.com/vulnerabilities/34867
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.