Internet Explorer 5.01, 5.5, and 6 allows remote attackers to spoof a less restrictive security zone and execute arbitrary code via an HTML page containing URLs that contain hostnames that have been double hex encoded, which are decoded twice to generate a malicious hostname, aka the "URL Decoding Zone Spoofing Vulnerability."

Threat-Mapped Scoring

Score: 1.8

Priority: P4 - Informational (Low)

• S9 – Sabotage of System/App

EPSS

Score: 0.38328
Percentile: 0.97074

CVSS Scoring

Affected Products

• cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1:*:*:*:*:*:*
• cpe:2.3:a:microsoft:internet_explorer:5.01:*:*:*:*:*:*:*
• cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*

← Back to Home