CVE-2005-4827: microsoft ie
Vulnerability summary
CVE-2005-4827 is a high (CVSS 7.5) vulnerability in microsoft ie. EPSS estimates a 11.20% chance of exploitation in the next 30 days, higher than 95.9% of scored vulnerabilities. 1 public exploit is recorded.
Timeline
- 07-02-2007PublishedVulnerability first disclosed.
- 08-08-2024Last modifiedVulnerability information updated.
Description
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name), which is supported by some proxy servers that convert tabs to spaces. NOTE: this issue can be leveraged to conduct referer spoofing, HTTP Request Smuggling, and other attacks.
CVSS metrics
1 score · 1 source · 1 versionEPSS trend
Probability
11.20%
Chance of exploitation in the next 30 days
Percentile
96%
Versus all other CVEs
30-day change
0.00 pp
From 11.20% on 18-09-2026
Known exploited
Compare KEV catalogsNot in any of the 3 tracked catalogs.
Public exploits
1 foundExploit Reference (securityfocus.com)
Maturity: unknown
Weaknesses
CWE · root causeNo weakness data has been published for this record.
Affected systems
Microsoft2 products
- ie6 | 6:sp1 | 6:windows_2000_sp4 | 6:windows_server_2003_sp1 | 6:windows_server_2003_sp1_itanium | 6:windows_server_2003_sp1_itanium_systems | 6:windows_xp_sp2 | 6.0 | 6.0:sp1 | 6.0:sp2 | 6.0:windows_xp_sp2
- internet_explorer6:sp1 | 6.0 | 6.0.2600 | 6.0.2800 | 6.0.2800.1106 | 6.0.2900.2180
1 vendor · 2 products