CVE-2003-1027
Summary
| CVE | CVE-2003-1027 |
|---|---|
| State | PUBLISHED |
| Assigner | mitre |
| Source Priority | CVE Program / NVD first with legacy fallback |
| Published | 2004-01-20 05:00:00 UTC |
| Updated | 2025-04-03 01:03:51 UTC |
| Description | Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability." |
Risk And Classification
Primary CVSS: v2.0 10 from [email protected]
AV:N/AC:L/Au:N/C:C/I:C/A:C
Problem Types: NVD-CWE-Other | n/a
CVSS v2.0 Breakdown
Access Vector
NetworkAccess Complexity
LowAuthentication
NoneConfidentiality
CompleteIntegrity
CompleteAvailability
CompleteAV:N/AC:L/Au:N/C:C/I:C/A:C
NVD Known Affected Configurations (CPE 2.3)
| Type | Vendor | Product | Version | Update | Edition | Language |
|---|---|---|---|---|---|---|
| Application | Microsoft | Ie | 6.0 | sp1 | All | All |
| Application | Microsoft | Internet Explorer | 5.0 | All | All | All |
| Application | Microsoft | Internet Explorer | 5.0.1 | All | All | All |
| Application | Microsoft | Internet Explorer | 5.0.1 | sp1 | All | All |
| Application | Microsoft | Internet Explorer | 5.0.1 | sp2 | All | All |
| Application | Microsoft | Internet Explorer | 5.0.1 | sp3 | All | All |
| Application | Microsoft | Internet Explorer | 5.5 | All | All | All |
| Application | Microsoft | Internet Explorer | 5.5 | sp1 | All | All |
| Application | Microsoft | Internet Explorer | 5.5 | sp2 | All | All |
| Application | Microsoft | Internet Explorer | 6.0 | All | All | All |
Vendor Declared Affected Products
References
| Reference | Source | Link | Tags |
|---|---|---|---|
| US-CERT Vulnerability Note VU#413886 | af854a3a-2127-422b-91ae-364da2661108 | www.kb.cert.org | Third Party Advisory, US Government Resource |
| 'Comments on 5 IE vulnerabilities' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Microsoft Security Bulletin MS04-004 - Critical | Microsoft Docs | af854a3a-2127-422b-91ae-364da2661108 | docs.microsoft.com | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| safecenter.net is for sale | af854a3a-2127-422b-91ae-364da2661108 | www.safecenter.net | |
| Microsoft Internet Explorer May Let Remote Users Read or Write Files Via the dragDrop() Method - SecurityTracker | af854a3a-2127-422b-91ae-364da2661108 | www.securitytracker.com | |
| US-CERT Technical Cyber Security Alert TA04-033A -- Multiple Vulnerabilities in Microsoft Internet Explorer | af854a3a-2127-422b-91ae-364da2661108 | www.us-cert.gov | US Government Resource |
| 'HijackClickV2 - a successor of HijackClick attack' - MARC | af854a3a-2127-422b-91ae-364da2661108 | marc.info | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| Repository / Oval Repository | af854a3a-2127-422b-91ae-364da2661108 | oval.cisecurity.org | |
| IBM X-Force Exchange | af854a3a-2127-422b-91ae-364da2661108 | exchange.xforce.ibmcloud.com | |
| CVE Program record | CVE.ORG | www.cve.org | canonical |
| NVD vulnerability detail | NVD | nvd.nist.gov | canonical, analysis |
No vendor comments have been submitted for this CVE.
There are currently no legacy QID mappings associated with this CVE.