CVE-2015-0072

MEDIUM 4.3CVE-2015-0072 · Published 07/02/2015 · updated 17/06/2026

Package	Affected versions	Patched versions
internet explorer microsoft	`= 10= 11= 9`	No fix yet

Description

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."

References

community.websense.com/blogs/securitylabs/archive/2015/02/05/another-day-another-zero-day-internet-explorer-s-turn-cve-2015-0072.aspx
innerht.ml/blog/ie-uxss.html · Exploit
packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Universal-XSS-Proof-Of-Concept.html · Exploit
seclists.org/fulldisclosure/2015/Feb/0
secunia.com/advisories/62658
pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-to-powerful-phishing-attacks.html
securityfocus.com/archive/1/534662/100/0/threaded
securityfocus.com/bid/72489
securitytracker.com/id/1031888
docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15-018
exchange.xforce.ibmcloud.com/vulnerabilities/100606
nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-site-scripting-zero-day-bug

Running one of these products? Scan your site to see whether it exposes a vulnerable version.

Scan my site free