Microsoft Security
CVE-2015-0072 is a cross-site scripting (XSS) vulnerability in Internet…
2 passages name itOriginal (opens in a new tab) ↗
CVE-2015-0072 Public exploit EPSS 71.7%
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass…
Summary
A cross-site scripting flaw in Microsoft Internet Explorer versions 9 through 11 allows the Same Origin Policy to be bypassed, enabling the injection of arbitrary script or HTML. An attacker can exploit it remotely through a crafted page that uses a redirecting IFRAME, a second non-redirecting IFRAME, and an eval of a WindowProxy object, with no authentication or configuration required beyond the victim browsing to that content.
Official description · CVE.org
Cross-site scripting (XSS) vulnerability in Microsoft Internet Explorer 9 through 11 allows remote attackers to bypass the Same Origin Policy and inject arbitrary web script or HTML via vectors involving an IFRAME element that triggers a redirect, a second IFRAME element that does not trigger a redirect, and an eval of a WindowProxy object, aka "Universal XSS (UXSS)."
Priority scorePatchfirst’s 0 to 100 ranking. It adds points for CISA KEV listing, ransomware use, EPSS, threat reports, public exploit code and CVSS. Every CVE page shows the breakdown. Breakdown
64.4 / 100
- Exploited
- Yes, in VulnCheck KEV
- Reports
- 1
- Tactics
- 0/15
Exploitation timelineDated milestones for a CVE: when it was disclosed, when exploit code became public, when exploitation was confirmed, and when threat reports named it.
First seen exploited 31 days after disclosure. Public exploit code (Metasploit) was available 6 days before disclosure.
- Public exploit codeMetasploit6 days before
- Disclosedday 0
- First seen exploitedVulnCheck KEV evidence+31 days
MITRE ATT&CKA public catalogue of the techniques attackers use, maintained by MITRE. Patchfirst uses it to describe what attackers do with a vulnerability. techniques
No techniques linkedNo high- or medium-confidence techniques. The 1 available link are lower confidence and listed below.
Lower-confidence links (1)
These come from early or generic mappings, text matching, or contradict this CVE’s details (for example a public-facing technique on a bug that needs a user to open a file). Shown for completeness.
- Exploit Public-Facing ApplicationT1190 CTID attack_to_cve Phase 1 "Uncategorized" mapping (not staged by impact)
What security researchers reported
Named in 1 threat report1 reportMicrosoft
Reports are matched by finding the exact id CVE-2015-0072 in their text; nobody has reviewed the match. One passage is shown per report, at most 320 characters, linked to the original.
Also mentioned in 1 community threat pulse (AlienVault OTX)
Weaker evidencePulses are indicator collections that anyone can publish. A mention is not confirmation of exploitation.