Public exploit available

Public proof-of-concept or exploit code exists (ExploitDB / Metasploit / Nuclei).

CVE-2006-2094 — Race Condition in Microsoft IE

CWE-362 — Race Condition4 documents4 sources

Severity

5.1MEDIUMNVD

EPSS

38.2%

top 2.77%

CISA KEV

Not in KEV

Exploit

PoC available

Public exploit / PoC exists

Affected products

Microsoft IE Microsoft Internet Explorer

Timeline

PublishedApr 29

Latest updateMay 1

Description

Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, uses modal dialogs to verify that a user wishes to run an ActiveX control or perform other risky actions, which allows user-assisted remote attackers to construct a race condition that tricks a user into clicking an object or pressing keys that are actually applied to a "Yes" approval for executing the control.

CVSS vector

AV:N/AC:H/C:P/I:P/A:PExploitability: 4.9 | Impact: 6.4

Affected Packages2 packages

▶NVDmicrosoft/internet_explorer5 versions+4

▶NVDmicrosoft/ie4 versions+3

🔴Vulnerability Details

GHSA

GHSA-cch6-f34q-jwvj: Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, u↗2022-05-01

▶

CVEList

CVE-2006-2094: Microsoft Internet Explorer before Windows XP Service Pack 2 and Windows Server 2003 Service Pack 1, when Prompt is configured in Security Settings, u↗2006-04-29

▶

💥Exploits & PoCs

Exploit-DB

Microsoft Internet Explorer 5.0.1 - Modal Dialog Manipulation↗2006-04-26

▶