CVE-2011-2382: Microsoft Ie

Medium severity, CVSS 4.3. EPSS: 19.3% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 8 and earlier, and Internet Explorer 9 beta, does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue.

Affected products

• Microsoft Ie: version 9 only
• Microsoft Internet Explorer: up to and including 8; version 3.0 only; version 3.0.1 only; version 3.0.2 only; version 3.1 only; version 3.2 only; …

Published 2011-06-03. Last modified 2026-06-16.