Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
7.5

Internet Explorer 5.5/6 runs cookie script as local

CVE-2002-0078 · published 24 years ago
Summary

Internet Explorer versions 5.5 and 6 can be tricked into treating a script hidden in a web cookie as if it came from the computer itself, allowing an attacker to run code on the user’s machine. This bypasses the browser’s normal security zones. The safest response is to stop using these versions, apply any available security updates, or switch to a newer, supported browser.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft internet_explorer 5.0.1
5.5
6.0
cpe:2.3:a:microsoft:internet_explorer:5.0.1:sp1:*:*:*:*:*:*
Original advisory text
The zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the script in a cookie, aka the "Cookie-bas...
The zone determination function in Microsoft Internet Explorer 5.5 and 6.0 allows remote attackers to run scripts in the Local Computer zone by embedding the script in a cookie, aka the "Cookie-based Script Execution" vulnerability.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
7.5 High
Exploitation
22% chance of attack within 30 days
Timeline
Published29 Mar 2002
Updated29 Sep 2026
First seen29 Sep 2026
Sources
CVE-2002-0078 · NVD
Track software like this
Free during beta