Description
The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
References
- 22701 vdb-entry
- 24314 third-party-advisory
- 20070223 Advisory 03/2007: Multiple Browsers Cross Domain Charset Inheritance Vulnerability mailing-list
- http://www.hardened-php.net/advisory_032007.142.html
- ADV-2007-0744 vdb-entry
- 32119 vdb-entry