CVE-2003-1025

Internet Explorer 5.01 through 6 SP1 allows remote attackers to spoof the domain of a URL via a "%01" character before an @ sign in the user@domain portion of the URL, which hides the rest of the URL, including the real site, in the address bar, aka the "Improper URL Canonicalization Vulnerability."

CVSS v2.0

4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N

EPSS

26.91% chance of exploitation in the next 30 days, 98th percentile

Published

2004-01-06

Updated

2024-08-08

ExploitDB entries (3)

• https://www.exploit-db.com/exploits/23465
• https://www.exploit-db.com/exploits/23423
• https://www.exploit-db.com/exploits/23422

References

• CVE Record
• NVD entry

Related

• CVE-2003-1017
• CVE-2003-1026
• CVE-2003-1006
• CVE-2003-1029
• CVE-2003-0990
• CVE-2003-1030