CVE-2009-2350

CVE Descriptions

Microsoft Internet Explorer 6.0.2900.2180 and earlier does not block javascript: URIs in Refresh headers in HTTP responses, which allows remote attackers to conduct cross-site scripting (XSS) attacks via vectors related to (1) injecting a Refresh header or (2) specifying the content of a Refresh header, a related issue to CVE-2009-1312.

CVE Informations

Related Weaknesses

CWE-ID	Weakness Name	Source
CWE-79	Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting') The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

Metrics

Metrics	Score	Severity	CVSS Vector	Source
V2	4.3		AV:N/AC:M/Au:N/C:N/I:P/A:N	nvd@nist.gov

EPSS

EPSS is a scoring model that predicts the likelihood of a vulnerability being exploited.

EPSS Score

The EPSS model produces a probability score between 0 and 1 (0 and 100%). The higher the score, the greater the probability that a vulnerability will be exploited.

Date	EPSS V0	EPSS V1	EPSS V2 (> 2022-02-04)	EPSS V3 (> 2025-03-07)	EPSS V4 (> 2025-03-17)
2022-02-06	–	–	17.17%	–	–
2022-04-03	–	–	12.04%	–	–
2022-07-17	–	–	1.92%	–	–
2022-07-24	–	–	12.04%	–	–
2023-03-12	–	–	–	1.47%	–
2023-08-27	–	–	–	2.52%	–
2024-01-07	–	–	–	4.92%	–
2024-02-11	–	–	–	4.92%	–
2024-03-31	–	–	–	6.8%	–
2024-06-02	–	–	–	6.8%	–
2024-06-02	–	–	–	6.8%	–
2024-12-22	–	–	–	43.71%	–
2025-02-23	–	–	–	49.57%	–
2025-01-19	–	–	–	43.71%	–
2025-02-23	–	–	–	49.57%	–
2025-03-18	–	–	–	–	10.47%
2025-03-30	–	–	–	–	13.29%
2025-03-30	–	–	–	–	13.29,%

EPSS Percentile

The percentile is used to rank CVE according to their EPSS score. For example, a CVE in the 95th percentile according to its EPSS score is more likely to be exploited than 95% of other CVE. Thus, the percentile is used to compare the EPSS score of a CVE with that of other CVE.

EPSS First.org

Date	Percentile
2022-02-06	93%
2022-04-03	95%
2022-07-17	77%
2022-07-24	95%
2023-03-12	85%
2023-08-27	89%
2024-01-07	92%
2024-02-11	93%
2024-03-31	94%
2024-06-02	94%
2024-06-02	94%
2024-12-22	97%
2025-02-23	98%
2025-01-19	97%
2025-02-23	98%
2025-03-18	93%
2025-03-30	94%
2025-03-30	94%

Exploit information

Exploit Database EDB-ID : 33063

Publication date : 2009-06-02 22h00 +00:00
Author : MustLive
EDB Verified : Yes

source: https://www.securityfocus.com/bid/35570/info Microsoft Internet Explorer is prone to a cross-site scripting vulnerability because it fails to properly sanitize user-supplied input. An attacker can exploit this issue to execute arbitrary script code in the context of the user running the application and to steal cookie-based authentication credentials and other sensitive data that may aid in further attacks. Internet Explorer 6 is vulnerable; other versions may also be affected. With request to script at web site: http://www.example.com/script.php?param=javascript:alert(document.cookie) Which returns in answer the refresh header: refresh: 0; URL=javascript:alert(document.cookie)