Description
Microsoft Internet Explorer 5.22, and other 5 through 6 SP1 versions, sends Referer headers containing https:// URLs in requests for http:// URLs, which allows remote attackers to obtain potentially sensitive information by reading Referer log data.
References
- 20031230 RE: IE 5.22 on Mac Transmitting HTTP Referer from Secure Page mailing-list
- http://www.gadgetopia.com/2003/12/23/OutlookWebAccessPrivacyHole.html
- 9295 vdb-entry
- 20031224 IE 5.22 on Mac Transmitting HTTP Referer from Secure Page mailing-list
- 3989 third-party-advisory