CVE-2002-1254: Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains…

PriorityP335high7.5CVSS 2.0

AVNACLAuNCPIPAP

EXPLOIT

EPSS

50.76%

98.8th percentile

Internet Explorer 5.5 and 6.0 allows remote attackers to bypass the cross-domain security model and access information on the local system or in other domains, and possibly execute code, via cached methods and objects, aka "Cross Domain Verification via Cached Methods."

Affected

3 ranges

Vendor	Product	Version range	Fixed in
microsoft	ie	—	—
microsoft	internet_explorer	—	—
microsoft	internet_explorer	—	—

Detection & IOCsextracted from sources · hover to see the quote

→Exploit pattern involves opening a child window to a local/same-domain page, caching a reference to its document object or methods, then navigating the child window to a different domain/zone — monitor for cross-domain window manipulation via cached object references in IE 5.5/6.0 ↗
→Exploit skeleton uses window.open() to a local HTML file followed by a location.href redirect to an external domain with a setTimeout callback to execute payload — look for this pattern in script blocks on untrusted pages ↗
→Successful exploitation enables cookie theft, website impersonation, and local file disclosure/manipulation — correlate with unexpected cross-zone document access or anomalous file reads from IE process ↗

·Internet Explorer 6.0 with Service Pack 1 and Internet Explorer 5 with Service Pack 2 are reported as NOT vulnerable, though some reports indicate IE6 SP1 may still be affected ↗
·Vulnerability affects the cross-domain security model specifically via cached methods/objects — access control checks are absent when a document object is accessed through a separate cached reference ↗

CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.