CVE-2008-2948

{"id": "CVE-2008-2948", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 6.8, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "PARTIAL", "confidentialityImpact": "PARTIAL"}, "acInsufInfo": false, "impactScore": 6.4, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": true, "userInteractionRequired": true}]}, "published": "2008-06-30T22:41:00.000", "references": [{"url": "http://blogs.zdnet.com/security/?p=1348", "source": "cve@mitre.org"}, {"url": "http://secunia.com/advisories/30851", "tags": ["Vendor Advisory"], "source": "cve@mitre.org"}, {"url": "http://sirdarckcat.blogspot.com/2008/05/ghosts-for-ie8-and-ie75730.html", "source": "cve@mitre.org"}, {"url": "http://technet.microsoft.com/en-us/security/cc405107.aspx#EHD", "source": "cve@mitre.org"}, {"url": "http://www.gnucitizen.org/blog/ghost-busters/", "source": "cve@mitre.org"}, {"url": "http://www.kb.cert.org/vuls/id/516627", "tags": ["US Government Resource"], "source": "cve@mitre.org"}, {"url": "http://www.vupen.com/english/advisories/2008/1941/references", "source": "cve@mitre.org"}], "vulnStatus": "Modified", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "NVD-CWE-Other"}]}], "descriptions": [{"lang": "en", "value": "Cross-domain vulnerability in Microsoft Internet Explorer 7 and 8 allows remote attackers to change the location property of a frame via the Object data type, and use a frame from a different domain to observe domain-independent events, as demonstrated by observing onkeydown events with caballero-listener. NOTE: according to Microsoft, this is a duplicate of CVE-2008-2947, possibly a different attack vector."}, {"lang": "es", "value": "Una vulnerabilidad de tipo cross-domain en Microsoft Internet Explorer versiones 7 y 8, permite a los atacantes remotos cambiar la propiedad de ubicaci\u00f3n de una trama por medio del tipo de dato Object y usar una trama de un dominio diferente para observar eventos independientes del dominio, como se demuestra mediante la observaci\u00f3n de eventos onkeydown con caballero-listener. NOTA: seg\u00fan Microsoft, este es un duplicado del CVE-2008-2947, posiblemente un vector de ataque diferente."}], "lastModified": "2021-07-23T15:04:56.060", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "1A33FA7F-BB2A-4C66-B608-72997A2BD1DB"}, {"criteria": "cpe:2.3:a:microsoft:internet_explorer:8:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "A52E757F-9B41-43B4-9D67-3FEDACA71283"}], "operator": "OR"}]}], "sourceIdentifier": "cve@mitre.org"}