Track vulnerabilities like this one. Sign up free to get alerted when software you use is affected.

CVE-2002-2311: Internet Explorer 6 lets attackers upload files via key press

CVE-2002-2311 · published 23 years ago

Summary

When a user visits a malicious web page and presses the Ctrl or Shift key, Internet Explorer 6 can be tricked into sending any file from the computer to the attacker. This could expose sensitive documents or allow further attacks. Upgrade to a newer browser or apply the vendor's security update to stop the behavior.

What to do

The CVE record does not list a fixed version. Check the vendor's site or the advisory links below - a fix may already be released.

Affected software

Vendor	Product	Affected versions
microsoft	internet_explorer	5.0 5.0.1 5.5 6.0 `cpe:2.3:a:microsoft:internet_explorer:5.0:::::::*`
opera_software	opera_web_browser	6.0.1 `cpe:2.3:a:opera_software:opera_web_browser:6.0.1:::::::*`

Original advisory text

Microsoft Internet Explorer 6.0 and possibly others allows remote attackers to upload arbitrary file contents when users press a key corresponding to the JavaScript (1) event.ctrlKey or (2) event.shiftKey onkeydown event contained in a webpage. NOTE: it was reported that the vendor has disputed the severity of this issue.

References

Fix within

Internet-facing 14 days

Internal 60 days

Not known to be exploited
Can be exploited automatically (estimated)
Gives an attacker partial control (estimated)

Severity

6.4 Medium

Exploitation

10% chance of attack within 30 days

Type

CWE-264Permissions, Privileges, and Access Controls

Timeline

Published31 Dec 2002

Updated15 Oct 2026

First seen29 Sep 2026

Sources

CVE-2002-2311 · NVD

Track software like this

Free during beta