CVE-2003-0838

Internet Explorer allows remote attackers to bypass zone restrictions to inject and execute arbitrary programs by creating a popup window and inserting ActiveX object code with a "data" tag pointing to the malicious code, which Internet Explorer treats as HTML or Javascript, but later executes as an HTA application, a different vulnerability than CVE-2003-0532, and as exploited using the QHosts Trojan horse (aka Trojan.Qhosts, QHosts-1, VBS.QHOSTS, or aolfix.exe).

CVSS v2.0

7.5 HIGHAV:N/AC:L/Au:N/C:P/I:P/A:P

EPSS

37.56% chance of exploitation in the next 30 days, 98th percentile

Published

2003-10-07

Updated

2024-08-08

ExploitDB entries (1)

• https://www.exploit-db.com/exploits/23114

References

• CVE Record
• NVD entry

Related

• CVE-2003-0835
• CVE-2003-0840
• CVE-2003-0834
• CVE-2003-0842
• CVE-2003-0833
• CVE-2003-0845