CVE-2009-2064

Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."
ProviderTypeBase ScoreAtk. VectorAtk. ComplexityPriv. RequiredVector
NISTNIST
6.8 UNKNOWN
NETWORK
MEDIUM
AV:N/AC:M/Au:N/C:P/I:P/A:P
mitreCNA
---
---
CVEADP
---
---
Base Score
CVSS 3.x
EPSS Score
Percentile: 94%
VendorProductVersion
microsoftinternet_explorer
𝑥
≤ 8
microsoftinternet_explorer
5.01:sp4
microsoftinternet_explorer
7.0.5730
microsoftinternet_explorer
8.0b:b
microsoftpocket_ie
1.0
microsoftpocket_ie
1.1
microsoftpocket_ie
2.0
microsoftpocket_ie
3.0
microsoftpocket_ie
4.0
𝑥
= Vulnerable software versions
Common Weakness Enumeration
References
http://research.microsoft.com/apps/pubs/default.aspx?id=79323
http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf
http://www.securityfocus.com/bid/35403
https://exchange.xforce.ibmcloud.com/vulnerabilities/51186
http://research.microsoft.com/apps/pubs/default.aspx?id=79323
http://research.microsoft.com/pubs/79323/pbp-final-with-update.pdf
http://www.securityfocus.com/bid/35403
https://exchange.xforce.ibmcloud.com/vulnerabilities/51186