CVE-2009-2064

Published: Jun 15, 2009Modified: Apr 23, 2026

6.8

Vector

AV:N/AC:M/Au:N/C:P/I:P/A:P

Exploitability: 8.6 / Impact: 6.4

Source: NVD

Description

Microsoft Internet Explorer 8, and possibly other versions, detects http content in https web pages only when the top-level frame uses https, which allows man-in-the-middle attackers to execute arbitrary web script, in an https site's context, by modifying an http page to include an https iframe that references a script file on an http site, related to "HTTP-Intended-but-HTTPS-Loadable (HPIHSL) pages."

Affected (18)

Products: Microsoft: Internet Explorer, Pocket Ie

Microsoft

2 products

Internet Explorer

Pocket Ie

Configuration A

18 vulnerable

Vulnerable Software	Affected Versions
Microsoft Internet Explorer	Up to 8
Microsoft Internet Explorer	Version 5.01 sp4
Microsoft Internet Explorer	Version 5
Microsoft Internet Explorer	Version 6
Microsoft Internet Explorer	Version 6 sp1
Microsoft Internet Explorer	Version 6 sp2
Microsoft Internet Explorer	Version 7.0.5730
Microsoft Internet Explorer	Version 7
Microsoft Internet Explorer	Version 8.0b
Microsoft Internet Explorer	Version 8
Microsoft Internet Explorer	Version 8 beta1
Microsoft Pocket Ie	Version 1.0
Microsoft Pocket Ie	Version 1.1
Microsoft Pocket Ie	Version 2.0
Microsoft Pocket Ie	Version 2002
Microsoft Pocket Ie	Version 2003
Microsoft Pocket Ie	Version 3.0
Microsoft Pocket Ie	Version 4.0