Unscored severity · published Jan 20, 2004
CVE-2003-1027
Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to…
–
CVSS
38.1%
EPSS
No
On KEV
Description
Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."
Exploitation
Is it being used?
Exploit prediction (EPSS)38.1% · higher than 99% of CVEs
Exploited in the wildNo evidence yet
CISA KEVNot listed
Ransomware campaign useNot known
Affected products
Which versions
IE
IE · Microsoft
6.0 · source: NVD
IE
Internet Explorer · Microsoft
5.0; 5.0.1; 5.0.1; 5.0.1; 5.0.1; 5.5; +3 more · source: NVD
References
NVD
https://nvd.nist.gov/vuln/detail/CVE-2003-1027
CVE.org
https://www.cve.org/CVERecord?id=CVE-2003-1027
marc.info
http://marc.info/?l=bugtraq&m=106979479719446&w=2
marc.info
http://marc.info/?l=bugtraq&m=107038202225587&w=2
Third Party Advisory
http://www.kb.cert.org/vuls/id/413886
www.safecenter.net
http://www.safecenter.net/UMBRELLAWEBV4/HijackClickV2
www.securitytracker.com
http://www.securitytracker.com/id?1006036
US Government Resource
http://www.us-cert.gov/cas/techalerts/TA04-033A.html
More from IE
8.8
CVE-2012-4792
Microsoft Internet Explorer Use-After-Free Vulnerability
8.8
CVE-2006-3730
Integer overflow in Microsoft Internet Explorer 6 on Windows XP SP2 allows remote attackers to cause a denial of service (crash) and execute arbitrary code via a 0x7fffffff…
–
CVE-2012-1545
Microsoft Internet Explorer 6 through 9, and 10 Consumer Preview, allows remote attackers to bypass Protected Mode or cause a denial of service (memory corruption) by leveraging…
–
CVE-2010-5071
The JavaScript implementation in Microsoft Internet Explorer 8.0 and earlier does not properly restrict the set of values contained in the object returned by the getComputedStyle…
–
CVE-2002-2435
The Cascading Style Sheets (CSS) implementation in Microsoft Internet Explorer 8.0 and earlier does not properly handle the :visited pseudo-class, which allows remote attackers to…