$ cve CVE-2003-1025 JSON

CVE-2003-1025 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 26.9% (pctl 98)

Patch early

A public exploit exists.

Description

Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	26.91% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-20
On CISA KEV	no
Public exploit	yes
Published	2004-01-20
Last modified	2026-06-16

Affected (1)

Vendor	Product
microsoft	internet explorer

Public exploits

Source	Title	Date
exploit-db	Opera Browser 6.0 6 - URI Display Obfuscation	2003-12-23
exploit-db	Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (1)	2003-12-09
exploit-db	Microsoft Internet Explorer 5/6 / Mozilla 1.2.1 - URI Display Obfuscation (2)	2003-12-09

References

→ the Explorer · watch your stack · NVD