Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.
5.0

Internet Explorer 5.5‑6 runs malicious script via Back button

CVE-2002-1688 · published 23 years ago
Summary

In Internet Explorer versions 5.5 through 6, the history feature can execute code that an attacker places in a crafted URL. When a user clicks the Back button, the injected code runs with the user's privileges and can capture login cookies. Update the browser to a supported version or apply the latest security patches, and consider using a more modern browser for safer web browsing.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software
VendorProductAffected versions
microsoft internet_explorer 5.5
6.0
cpe:2.3:a:microsoft:internet_explorer:5.5:*:*:*:*:*:*:*
Original advisory text
The browser history feature in Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to execute arbitrary script as other users and steal authentication information via cookies by inj...
The browser history feature in Microsoft Internet Explorer 5.5 through 6.0 allows remote attackers to execute arbitrary script as other users and steal authentication information via cookies by injecting JavaScript into the URL, which is executed when the user hits the Back button.
References
Fix within
Internet-facing 14 days
Internal 60 days
  • Not known to be exploited
  • Can be exploited automatically (estimated)
  • Gives an attacker partial control (estimated)
Severity
5.0 Medium
Exploitation
17% chance of attack within 30 days
Timeline
Published31 Dec 2002
Updated3 Nov 2026
First seen29 Sep 2026
Sources
CVE-2002-1688 · NVD
Track software like this
Free during beta