CVE-2011-2383: Microsoft Ie

Medium severity, CVSS 4.3. EPSS: 20.8% chance of exploitation in the next 30 days.

Microsoft Internet Explorer 9 and earlier does not properly restrict cross-zone drag-and-drop actions, which allows user-assisted remote attackers to read cookie files via vectors involving an IFRAME element with a SRC attribute containing an http: URL that redirects to a file: URL, as demonstrated by a Facebook game, related to a "cookiejacking" issue, aka "Drag and Drop Information Disclosure Vulnerability." NOTE: this vulnerability exists because of an incomplete fix in the Internet Explorer 9 release.

Affected products

• Microsoft Ie: version 9 only
• Microsoft Internet Explorer: up to and including 9; version 3.0 only; version 4.0 only; version 5 only; version 6 only; version 7 only; …

Published 2011-06-03. Last modified 2026-06-16.