CVE-2011-1244 : Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restric

Microsoft Internet Explorer 6, 7, and 8 does not enforce intended domain restrictions on content access, which allows remote attackers to obtain sensitive information or conduct clickjacking attacks via a crafted web site, aka "Frame Tag Information Disclosure Vulnerability."

Published 2011-04-13 18:55:02

Updated 2025-04-11 00:51:22

Source Microsoft Corporation

View at NVD, CVE.org

Vulnerability category: Information leak

Products affected by CVE-2011-1244

Microsoft » Internet Explorer » Version: 6
cpe:2.3:a:microsoft:internet_explorer:6:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2003 » Version: N/A Update SP2
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 For X64
When used together with: Microsoft » Windows Xp » Version: N/A Update SP3
Microsoft » Internet Explorer » Version: 7
cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows Server 2003 » Version: N/A Update SP2
When used together with: Microsoft » Windows Server 2008 » Version: N/A
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP1
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 Professional Edition For X64
When used together with: Microsoft » Windows Xp » Version: N/A Update SP3
Microsoft » Internet Explorer » Version: 8
cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 7 » Version: N/A
When used together with: Microsoft » Windows Server 2003 » Version: N/A Update SP2
When used together with: Microsoft » Windows Server 2008 » Version: N/A
When used together with: Microsoft » Windows Server 2008 » Version: N/A Update SP2
When used together with: Microsoft » Windows Server 2008 » Version: R2
When used together with: Microsoft » Windows Vista » Version: N/A Update SP1
When used together with: Microsoft » Windows Vista » Version: N/A Update SP2
When used together with: Microsoft » Windows Xp » Version: N/A Update SP2 Professional Edition For X64
When used together with: Microsoft » Windows Xp » Version: N/A Update SP3

Exploit prediction scoring system (EPSS) score for CVE-2011-1244

EPSS FAQ

7.00%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 91 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2011-1244

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
5.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:N	8.6	4.9	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: None

CWE ids for CVE-2011-1244

CWE-1021 Improper Restriction of Rendered UI Layers or Frames

The web application does not restrict or incorrectly restricts frame objects or UI layers that belong to another application or domain, which can lead to user confusion about which interface the user is interacting with.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2011-1244

http://osvdb.org/71777

Broken Link
http://www.securitytracker.com/id?1025327

Microsoft Internet Explorer Bugs Let Remote Users Obtain Potentially Sensitive Information, Execute Arbitrary Code, and Hijack User Clicks - SecurityTracker
Broken Link;Third Party Advisory;VDB Entry

CVEs referencing this url
http://www.securityfocus.com/bid/47191

Microsoft Internet Explorer Frame Tag Cross Domain Information Disclosure Vulnerability
Broken Link;Third Party Advisory;VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A11926

Repository / Oval Repository
Tool Signature
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-018

Microsoft Security Bulletin MS11-018 - Critical | Microsoft Docs
Patch;Vendor Advisory

CVEs referencing this url

Jump to

Vulnerability Details : CVE-2011-1244

Products affected by CVE-2011-1244

Exploit prediction scoring system (EPSS) score for CVE-2011-1244

CVSS scores for CVE-2011-1244

CWE ids for CVE-2011-1244

References for CVE-2011-1244