CVE-2009-2350

MEDIUM 4.3CVE-2009-2350 · Published 07/07/2009 · updated 16/06/2026

Package	Affected versions	Patched versions
internet explorer microsoft	`= 6`	No fix yet

Description

Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312.

References

websecurity.com.ua/3275 · Exploit
websecurity.com.ua/3386
securityfocus.com/archive/1/504718/100/0/threaded
securityfocus.com/archive/1/504723/100/0/threaded
securityfocus.com/bid/35570 · Exploit

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free