$ cve CVE-2003-0816 JSON

CVE-2003-0816 EXPLOIT

7.5

HIGH · CVSS 2.0 · EPSS 48.4% (pctl 99)

Patch early

A public exploit exists.

Description

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions by (1) using the NavigateAndFind method to load a file: URL containing Javascript, as demonstrated by NAFfileJPU, (2) using the window.open method to load a file: URL containing Javascript, as demonstrated using WsOpenFileJPU, (3) setting the href property in the base tag for the _search window, as demonstrated using WsBASEjpu, (4) loading the search window into an Iframe, as demonstrated using WsFakeSrc, (5) caching a javascript: URL in the browser history, then accessing that URL in the same frame as the target domain, as demonstrated using WsOpenJpuInHistory, NAFjpuInHistory, BackMyParent, BackMyParent2, and RefBack, aka the "Script URLs Cross Domain" vulnerability.

Scoring

CVSS	7.5 (HIGH, v2.0)
Vector	AV:N/AC:L/Au:N/C:P/I:P/A:P
EPSS	48.37% — more likely to be exploited than 99% of all CVEs
On CISA KEV	no
Public exploit	yes
Published	2004-02-03
Last modified	2026-06-16

Affected (2)

Vendor	Product
microsoft	ie
microsoft	internet explorer

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer 6 - Script Execution	2003-09-10
exploit-db	Microsoft Internet Explorer 5 - window.open Search Pane Cross-Zone Scripting	2003-09-10

References

→ the Explorer · watch your stack · NVD