Executive Summary



This Alert is flagged as TOP 25 Common Weakness Enumeration from CWE/SANS. For more information, you can read this.
Informations
Name CVE-2015-0072 First vendor Publication 2015-02-07
Vendor Cve Last vendor Modification 2024-11-21

Security-Database Scoring CVSS v3

Cvss vector : N/A
Overall CVSS Score NA
Base Score NA Environmental Score NA
impact SubScore NA Temporal Score NA
Exploitabality Sub Score NA
 
Calculate full CVSS 3.0 Vectors scores

Security-Database Scoring CVSS v2

Cvss vector : (AV:N/AC:M/Au:N/C:N/I:P/A:N)
Cvss Base Score 4.3 Attack Range Network
Cvss Impact Score 2.9 Attack Complexity Medium
Cvss Expoit Score 8.6 Authentication None Required
Calculate full CVSS 2.0 Vectors scores

Detail

Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."

Original Source

Url : http://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2015-0072

CWE : Common Weakness Enumeration

% Id Name
100 % CWE-79 Failure to Preserve Web Page Structure ('Cross-site Scripting') (CWE/SANS Top 25)

OVAL Definitions

Definition Id: oval:org.mitre.oval:def:28737
 
Oval ID: oval:org.mitre.oval:def:28737
Title: Internet Explorer elevation of privilege vulnerability - CVE-2015-0072 (MS15-018)
Description: Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Family: windows Class: vulnerability
Reference(s): CVE-2015-0072
 Version: 3
Platform(s): Microsoft Windows Vista
Microsoft Windows Server 2008
Microsoft Windows 7
Microsoft Windows Server 2008 R2
Microsoft Windows 8
Microsoft Windows Server 2012
Microsoft Windows 8.1
Microsoft Windows Server 2012 R2
 Product(s): Microsoft Internet Explorer 9
Microsoft Internet Explorer 10
Microsoft Internet Explorer 11
Definition Synopsis:

CPE : Common Platform Enumeration

TypeDescriptionCount
Application 3

Snort® IPS/IDS

Date Description
2015-08-04 Microsoft Internet Explorer CTreeNode use-after-free attempt
RuleID : 35013 - Revision : 3 - Type : BROWSER-IE
2015-08-04 Microsoft Internet Explorer CTreeNode use-after-free attempt
RuleID : 35012 - Revision : 3 - Type : BROWSER-IE
2015-04-23 Microsoft Internet Explorer javascript iframe injection attempt
RuleID : 33898 - Revision : 4 - Type : BROWSER-IE
2015-04-23 Microsoft Internet Explorer javascript iframe injection attempt
RuleID : 33897 - Revision : 4 - Type : BROWSER-IE
2015-04-14 Microsoft Internet Explorer 11 CInputContext object use after free attempt
RuleID : 33764 - Revision : 2 - Type : BROWSER-IE
2015-04-14 Microsoft Internet Explorer 11 CInputContext object use after free attempt
RuleID : 33763 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer table cell out-of-bounds access attempt
RuleID : 33744 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer table cell out-of-bounds access attempt
RuleID : 33743 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CTreeNode use-after-free attempt
RuleID : 33742 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CTreeNode use-after-free attempt
RuleID : 33741 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer 11 CInputContext object use after free attempt
RuleID : 33739 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer 11 CInputContext object use after free attempt
RuleID : 33738 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CGeneratedTreeNode use after free attempt
RuleID : 33737 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CGeneratedTreeNode use after free attempt
RuleID : 33736 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer out of bounds array access attempt
RuleID : 33731 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer out of bounds array access attempt
RuleID : 33730 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CMarkup object use after free attempt
RuleID : 33727 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CMarkup object use after free attempt
RuleID : 33726 - Revision : 2 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer 11 sandbox bypass attempt
RuleID : 33721 - Revision : 3 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer 11 sandbox bypass attempt
RuleID : 33720 - Revision : 3 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CTreeNode interpreted as CGeneratedTreeNode remot...
RuleID : 33719 - Revision : 3 - Type : BROWSER-IE
2015-04-10 Microsoft Internet Explorer CTreeNode interpreted as CGeneratedTreeNode remot...
RuleID : 33718 - Revision : 3 - Type : BROWSER-IE
2015-04-07 Microsoft Internet Explorer 11 VBScript array element use after free attempt
RuleID : 33710 - Revision : 2 - Type : BROWSER-IE
2015-04-07 Microsoft Internet Explorer 11 VBScript array element use after free attempt
RuleID : 33709 - Revision : 2 - Type : BROWSER-IE
2015-04-07 Microsoft Internet Explorer use after free attempt
RuleID : 33708 - Revision : 2 - Type : BROWSER-IE
2015-04-07 Microsoft Internet Explorer use after free attempt
RuleID : 33707 - Revision : 2 - Type : BROWSER-IE
2015-03-10 Microsoft Internet Explorer same origin policy bypass attempt
RuleID : 33288 - Revision : 7 - Type : BROWSER-IE
2015-03-10 Microsoft Internet Explorer same origin policy bypass attempt
RuleID : 33287 - Revision : 7 - Type : BROWSER-IE

Nessus® Vulnerability Scanner

Date Description
2015-03-10 Name : The remote host has a web browser installed that is affected by multiple vuln...
File : smb_nt_ms15-018.nasl - Type : ACT_GATHER_INFO

Sources (Detail)

http://community.websense.com/blogs/securitylabs/archive/2015/02/05/another-d...
http://innerht.ml/blog/ie-uxss.html
http://packetstormsecurity.com/files/130308/Microsoft-Internet-Explorer-Unive...
http://seclists.org/fulldisclosure/2015/Feb/0
http://secunia.com/advisories/62658
http://www.pcworld.com/article/2879372/dangerous-ie-vulnerability-opens-door-...
http://www.securityfocus.com/archive/1/534662/100/0/threaded
http://www.securityfocus.com/bid/72489
http://www.securitytracker.com/id/1031888
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2015/ms15...
https://exchange.xforce.ibmcloud.com/vulnerabilities/100606
https://nakedsecurity.sophos.com/2015/02/04/internet-explorer-has-a-cross-sit...
Source Url

Alert History

If you want to see full details history, please login or register.
0
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
Date Informations
2024-11-28 12:44:28
  • Multiple Updates
2021-05-04 12:36:01
  • Multiple Updates
2021-04-22 01:43:44
  • Multiple Updates
2020-05-23 13:17:06
  • Multiple Updates
2020-05-23 00:43:20
  • Multiple Updates
2018-10-13 05:18:51
  • Multiple Updates
2018-10-10 00:19:54
  • Multiple Updates
2017-09-08 09:23:16
  • Multiple Updates
2016-03-04 05:23:48
  • Multiple Updates
2016-03-04 01:34:15
  • Multiple Updates
2015-11-17 09:22:59
  • Multiple Updates
2015-04-23 21:26:14
  • Multiple Updates
2015-03-18 09:28:26
  • Multiple Updates
2015-03-12 09:24:30
  • Multiple Updates
2015-03-11 13:24:58
  • Multiple Updates
2015-03-10 21:24:06
  • Multiple Updates
2015-02-17 21:24:40
  • Multiple Updates
2015-02-14 09:22:52
  • Multiple Updates
2015-02-13 05:22:06
  • Multiple Updates
2015-02-10 00:22:33
  • Multiple Updates
2015-02-08 00:22:57
  • First insertion