CVE-2006-4685

Published: Oct 10, 2006Modified: Apr 23, 2026

2.6

Vector

AV:N/AC:H/Au:N/C:P/I:N/A:N

Exploitability: 4.9 / Impact: 2.9

Source: NVD

Description

The XMLHTTP ActiveX control in Microsoft XML Parser 2.6 and XML Core Services 3.0 through 6.0 does not properly handle HTTP server-side redirects, which allows remote user-assisted attackers to access content from other domains.

Affected (4)

Products: Microsoft: Xml Core Services, Xml Parser

Microsoft

2 products

Xml Core Services

Xml Parser

Configuration A

4 vulnerable

Vulnerable Software	Affected Versions
Microsoft Xml Core Services	Version 3.0
Microsoft Xml Core Services	Version 4.0
Microsoft Xml Core Services	Version 6.0
Microsoft Xml Parser	Version 2.6

References (18)

http://secunia.com/advisories/22333

Source: secure@microsoft.com

http://securitytracker.com/id?1017033

Source: secure@microsoft.com

http://www.kb.cert.org/vuls/id/547212

Source: secure@microsoft.com

US Government Resource

http://www.osvdb.org/29425

Source: secure@microsoft.com

http://www.securityfocus.com/archive/1/449179/100/0/threaded

Source: secure@microsoft.com

http://www.securityfocus.com/bid/20339

Source: secure@microsoft.com

http://www.vupen.com/english/advisories/2006/3980

Source: secure@microsoft.com

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-061

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A221

Source: secure@microsoft.com

http://secunia.com/advisories/22333