CVE-2004-1155
Estado: ModificadaAlta (7.5)—
Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the "window injection" vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable.
CVSS
- Versión: 2.0
- Vector: AV:N/AC:L/Au:N/C:P/I:P/A:P
- Puntuación base: 7.5
Probabilidad de explotación (EPSS)
- Probabilidad de explotación en los próximos 30 días: 13%
- Percentil entre todas las CVEs puntuadas: 96
- Fecha de la puntuación: 9/10/2026
EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).
Tecnologías afectadas (2)
CWE
- NVD-CWE-Other
Referencias
- http://secunia.com/advisories/13251/
- http://secunia.com/advisories/22628
- http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
- http://secunia.com/secunia_research/2004-13/advisory/
- http://www.securityfocus.com/archive/1/449917/100/0/threaded
- http://www.securityfocus.com/bid/11855
- http://secunia.com/advisories/13251/
- http://secunia.com/advisories/22628
- http://secunia.com/multiple_browsers_window_injection_vulnerability_test/
- http://secunia.com/secunia_research/2004-13/advisory/
- http://www.securityfocus.com/archive/1/449917/100/0/threaded
- http://www.securityfocus.com/bid/11855
JSON original (NVD)
Mostrar
{
"id": "CVE-2004-1155",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 7.5,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:L/Au:N/C:P/I:P/A:P",
"authentication": "NONE",
"integrityImpact": "PARTIAL",
"accessComplexity": "LOW",
"availabilityImpact": "PARTIAL",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 6.4,
"baseSeverity": "HIGH",
"obtainAllPrivilege": false,
"exploitabilityScore": 10,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": true,
"userInteractionRequired": false
}
]
},
"affected": [
{
"source": "cve@mitre.org",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2004-12-31T05:00:00.000",
"references": [
{
"url": "http://secunia.com/advisories/13251/",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/22628",
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/multiple_browsers_window_injection_vulnerability_test/",
"tags": [
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/secunia_research/2004-13/advisory/",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/archive/1/449917/100/0/threaded",
"source": "cve@mitre.org"
},
{
"url": "http://www.securityfocus.com/bid/11855",
"tags": [
"Exploit",
"Vendor Advisory"
],
"source": "cve@mitre.org"
},
{
"url": "http://secunia.com/advisories/13251/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/22628",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/multiple_browsers_window_injection_vulnerability_test/",
"tags": [
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/secunia_research/2004-13/advisory/",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/449917/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/11855",
"tags": [
"Exploit",
"Vendor Advisory"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "Internet Explorer 5.01 through 6 allows remote attackers to spoof arbitrary web sites by injecting content from one window into another window whose name is known but resides in a different domain, as demonstrated using a pop-up window on a trusted web site, aka the \"window injection\" vulnerability. NOTE: later research shows that Internet Explorer 7 on Windows XP SP2 is also vulnerable."
}
],
"lastModified": "2026-06-16T22:07:09.133",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:ie:5.0.1:*:windows_2000:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "9F9AE3DB-EB7C-4B17-AF7A-CD8FC3C77070"
},
{
"criteria": "cpe:2.3:a:microsoft:ie:5.0.1:*:windows_95:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "151FE30E-9320-495C-84AD-60893FAED223"
},
{
"criteria": "cpe:2.3:a:microsoft:ie:5.0.1:*:windows_98:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "5805FB74-2AD6-4919-BAAE-D995CA2650A7"
},
{
"criteria": "cpe:2.3:a:microsoft:ie:5.0.1:*:windows_nt_4.0:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0D328337-A2FE-4E2E-8A8D-C170DC0A88E6"
},
{
"criteria": "cpe:2.3:a:microsoft:ie:5.2.3:*:macintosh:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "EB51F2D6-3CCA-4695-8A92-39999749B3DB"
},
{
"criteria": "cpe:2.3:a:microsoft:ie:6.0:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "24DF2AB3-DEAB-4D70-986E-FFBB7E64B96A"
},
{
"criteria": "cpe:2.3:a:microsoft:ie:6.0:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DA3D2175-7DF7-4D57-8B26-5BA68EF7A935"
},
{
"criteria": "cpe:2.3:a:microsoft:ie:7.0:windows_xp_sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "DF4D6428-CD8B-4155-A876-89B0938AC02E"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.0.1:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "3A04FEA6-37B0-44B0-844F-55652ABA1F85"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "4D56FB8E-2553-47C1-82A2-9E59023780CE"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8541EEED-94F4-42F8-9719-57F3EC85D52B"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp3:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40372520-08CF-4F64-A7AC-7E0AE0964138"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp4:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2EB39B99-91A0-4B70-B12A-BA37F6AFBA83"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "40F8042F-C621-45AE-9F8C-70469579643A"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.5:preview:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "8E93C22E-812E-4CDA-9850-2386CE1E817A"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.5:sp1:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "2CD04E07-3664-4D4F-BF3E-6B33AF0F2D12"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:5.5:sp2:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "D05ED9D0-CF78-4FAD-9371-6FB3D5825148"
},
{
"criteria": "cpe:2.3:a:microsoft:internet_explorer:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "A19F6133-25D1-44A5-B6B9-354703436783"
}
],
"operator": "OR"
}
]
}
],
"sourceIdentifier": "cve@mitre.org"
}