CVE-2006-3643

CVSS V2 Medium 6 CVSS V3 None

Description

Cross-site scripting (XSS) vulnerability in Internet Explorer 5.01 and 6 in Microsoft Windows 2000 SP4 permits access to local "HTML-embedded resource files" in the Microsoft Management Console (MMC) library, which allows remote authenticated users to execute arbitrary commands, aka "MMC Redirect Cross-Site Scripting Vulnerability."

Overview

CVE ID
CVE-2006-3643

Assigner
secure@microsoft.com

Vulnerability Status
Modified

Published Version
2006-08-09T00:04:00

Last Modified Date
2021-07-23T12:18:31

Weakness Enumerations

CWE	URL
CWE-79	http://cwe.mitre.org/data/definitions/79.html

CPE Configuration (Product)

CPE	Vulnerable	Operator	Version Start	Version End
cpe:2.3:a:microsoft:ie:6:windows_server_2003_sp1::::::	1	OR
cpe:2.3:a:microsoft:internet_explorer:5.01:::::::*	1	OR

CVSS Version 2

Version
2.0

Vector String
AV:N/AC:M/Au:S/C:P/I:P/A:P

Access Vector
NETWORK

Access Compatibility
MEDIUM

Authentication
SINGLE

Confidentiality Impact
PARTIAL

Integrity Impact
PARTIAL

Availability Impact
PARTIAL

Base Score
6

Severity
MEDIUM

Exploitability Score
6.8

Impact Score
6.4

References

Reference URL	Reference Tags
http://www.us-cert.gov/cas/techalerts/TA06-220A.html	Patch US Government Resource
http://www.kb.cert.org/vuls/id/927548	Patch US Government Resource
http://www.securityfocus.com/bid/19417
http://securitytracker.com/id?1016655
http://secunia.com/advisories/21401
http://www.vupen.com/english/advisories/2006/3213
https://exchange.xforce.ibmcloud.com/vulnerabilities/28005
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A638
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2006/ms06-044

Sources

Source Name	Source URL
NIST	https://nvd.nist.gov/vuln/detail/CVE-2006-3643
MITRE	https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2006-3643

History

Created	Old Value	New Value	Data Type	Notes
2022-05-10 15:54:12				Added to TrackCVE