CVE-2011-0096

Published: Jan 31, 2011Modified: Apr 29, 2026

6.1

Vector

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:C/C:L/I:L/A:N

Exploitability: 2.8 / Impact: 2.7

Source: 134c704f-9b21-4f2e-91b3-4a467353bcc0 (Secondary)

Description

The MHTML protocol handler in Microsoft Windows XP SP2 and SP3, Windows Server 2003 SP2, Windows Vista SP1 and SP2, Windows Server 2008 Gold, SP2, R2, and R2 SP1, and Windows 7 Gold and SP1 does not properly handle a MIME format in a request for content blocks in a document, which allows remote attackers to conduct cross-site scripting (XSS) attacks via a crafted web site that is visited in Internet Explorer, aka "MHTML Mime-Formatted Request Vulnerability."

Affected (16)

Products: Microsoft: Windows 2003 Server, Windows 7, Windows Server 2003, Windows Server 2008, Windows Vista, Windows Xp

6 products

Windows 2003 Server

Windows Server 2003

Windows Server 2008

Configuration A

16 vulnerable

Vulnerable Software	Affected Versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 2003 Server	All versions
Microsoft Windows 7	All versions
Microsoft Windows Server 2003	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	All versions
Microsoft Windows Server 2008	Version r2
Microsoft Windows Server 2008	Version r2
Microsoft Windows Vista	All versions
Microsoft Windows Vista	All versions
Microsoft Windows Xp	All versions
Microsoft Windows Xp	All versions

Related CWEs

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

The product does not neutralize or incorrectly neutralizes user-controllable input before it is placed in output that is used as a web page that is served to other users.

References (30)

http://blogs.technet.com/b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx

Source: secure@microsoft.com

http://blogs.technet.com/b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx

Source: secure@microsoft.com

http://osvdb.org/70693

Source: secure@microsoft.com

http://secunia.com/advisories/43093

Source: secure@microsoft.com

Vendor Advisory

http://www.80vul.com/webzine_0x05/0x05%20IE%E4%B8%8BMHTML%E5%8D%8F%E8%AE%AE%E5%B8%A6%E6%9D%A5%E7%9A%84%E8%B7%A8%E5%9F%9F%E5%8D%B1%E5%AE%B3.html

Source: secure@microsoft.com

Exploit

http://www.exploit-db.com/exploits/16071

Source: secure@microsoft.com

Exploit

http://www.kb.cert.org/vuls/id/326549

Source: secure@microsoft.com

US Government Resource

http://www.microsoft.com/technet/security/advisory/2501696.mspx

Source: secure@microsoft.com

Vendor Advisory

http://www.securityfocus.com/bid/46055

Source: secure@microsoft.com

http://www.securitytracker.com/id?1025003

Source: secure@microsoft.com

http://www.us-cert.gov/cas/techalerts/TA11-102A.html

Source: secure@microsoft.com

US Government Resource

http://www.vupen.com/english/advisories/2011/0242

Source: secure@microsoft.com

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-026

Source: secure@microsoft.com

https://exchange.xforce.ibmcloud.com/vulnerabilities/65000

Source: secure@microsoft.com

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6956

Source: secure@microsoft.com

http://blogs.technet.com/b/msrc/archive/2011/01/28/microsoft-releases-security-advisory-2501696.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

http://blogs.technet.com/b/srd/archive/2011/01/28/more-information-about-the-mhtml-script-injection-vulnerability.aspx

Source: af854a3a-2127-422b-91ae-364da2661108

http://osvdb.org/70693

Source: af854a3a-2127-422b-91ae-364da2661108

http://secunia.com/advisories/43093

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.80vul.com/webzine_0x05/0x05%20IE%E4%B8%8BMHTML%E5%8D%8F%E8%AE%AE%E5%B8%A6%E6%9D%A5%E7%9A%84%E8%B7%A8%E5%9F%9F%E5%8D%B1%E5%AE%B3.html

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.exploit-db.com/exploits/16071

Source: af854a3a-2127-422b-91ae-364da2661108

Exploit

http://www.kb.cert.org/vuls/id/326549

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.microsoft.com/technet/security/advisory/2501696.mspx

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

http://www.securityfocus.com/bid/46055

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.securitytracker.com/id?1025003

Source: af854a3a-2127-422b-91ae-364da2661108

http://www.us-cert.gov/cas/techalerts/TA11-102A.html

Source: af854a3a-2127-422b-91ae-364da2661108

US Government Resource

http://www.vupen.com/english/advisories/2011/0242

Source: af854a3a-2127-422b-91ae-364da2661108

Vendor Advisory

https://docs.microsoft.com/en-us/security-updates/securitybulletins/2011/ms11-026

Source: af854a3a-2127-422b-91ae-364da2661108

https://exchange.xforce.ibmcloud.com/vulnerabilities/65000

Source: af854a3a-2127-422b-91ae-364da2661108

https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6956

Source: af854a3a-2127-422b-91ae-364da2661108

Timeline

No history available yet.