News
Vigil@nce: IE 7, changing the content of a FRAME
June 2008 by Vigil@nce
SYNTHESIS
An attacker can create a malicious HTML page changing the content
of the FRAME of another site.
Gravity: 2/4
Consequences: disguisement
Provenance: internet server
Means of attack: no proof of concept, no attack
Ability of attacker: expert (4/4)
Confidence: multiples sources (3/5)
Diffusion of the vulnerable configuration: high (3/3)
Creation date: 27/06/2008
Identifier: VIGILANCE-VUL-7918
IMPACTED PRODUCTS
– Microsoft Internet Explorer [confidential versions]
DESCRIPTION
The "location" property of a FRAME indicates its url. The url of a
FRAME of another website cannot be changed.
However, if the "location" property receives a JavaScript string,
the url is changed as well as the content of the FRAME.
An attacker can therefore for example spoof the content of a
website.
CHARACTERISTICS
Identifiers: VIGILANCE-VUL-7918
