Back
CVE-2005-4827
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests…
High7.5EPSS 11.2%
- Published
- Updated
- Reserved
- Assigned by
- mitre
Description
Internet Explorer 6.0, and possibly other versions, allows remote attackers to bypass the same origin security policy and make requests outside of the intended domain by calling open on an XMLHttpRequest object (Microsoft.XMLHTTP) and using tab, newline, and carriage return characters within the first argument (method name), which is supported by some proxy servers that convert tabs to spaces. NOTE: this issue can be leveraged to conduct referer spoofing, HTTP Request Smuggling, and other attacks.
Scores
| Scored by | CVSS | Score | Vector |
|---|---|---|---|
| NVDNVD · Modified | 2.0 | High7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
- EPSS (exploitation in 30 days)
- 11.2% · top 4.0% of all CVEs (4 Nov 2026)
Loading the EPSS history…
The list uses the assigner's score when there is one, then CISA's, then NVD's: High 7.5.
Weakness
- n/a
Affected products
n/a
- affected n/a
References (4)
- 20070203 Web 2.0 backdoors made easy with MSIE & XMLHttpRequest (opens in a new tab)mailing-listx_refsource_FULLDISCx_transferred
- 20070204 Re: Web 2.0 backdoors made easy with MSIE & XMLHttpRequest (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
- 14969 (opens in a new tab)vdb-entryx_refsource_BIDx_transferred
- 20050924 "Exploiting the XmlHttpRequest object in IE" - paper by Amit Klein (opens in a new tab)mailing-listx_refsource_BUGTRAQx_transferred
Sources
The same CVE in the primary databases and aggregators, to check against.
- CVE.org record (opens in a new tab)
- CVE List JSON (GitHub) (opens in a new tab)
- NVD (opens in a new tab)
- FIRST EPSS (opens in a new tab)
- OSV.dev (opens in a new tab)
- GitHub Advisories (opens in a new tab)
- CIRCL Vulnerability-Lookup (opens in a new tab)
Badge for a README or a ticket
[](https://trackcve.app/cve/CVE-2005-4827)Record last updated .