Public exploit available
Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2001-0150 — Argument Injection in Microsoft Internet Explorer

CWE-88 — Argument Injection6 documents4 sources
Severity
7.3HIGHNVD
NVD5.1
EPSS
14.4%
top 5.55%
CISA KEV
Not in KEV
Exploit
PoC available
Public exploit / PoC exists
Affected products
1
Microsoft Internet Explorer
Timeline
PublishedJun 2
Latest updateApr 30

Description

Internet Explorer 5.5 and earlier executes Telnet sessions using command line arguments that are specified by the web site, which could allow remote attackers to execute arbitrary commands if the IE client is using the Telnet client provided in Services for Unix (SFU) 2.0, which creates session transcripts.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages1 packages

Patches

Patch: docs.microsoft.com ↗Patch: docs.microsoft.com ↗

🔴Vulnerability Details

2
GHSA
GHSA-42w8-jq8g-mg7m: Internet Explorer 6 and earlier, when used with the Telnet client in Services for Unix (SFU) 2↗2022-04-30
▶
GHSA
GHSA-w99v-7jp5-46gc: Internet Explorer 5↗2022-04-30
▶

💥Exploits & PoCs

1
Exploit-DB
Microsoft Internet Explorer 5.0.1/5.5/6.0 - Telnet Client File Overwrite↗2001-03-09
▶

📐Framework References

1
CWE
Improper Neutralization of Argument Delimiters in a Command ('Argument Injection')↗
▶
CVE-2001-0150 — Argument Injection in Microsoft | cvebase