CVE-2009-1140
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for...
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Cross-Domain Information Disclosure Vulnerability."
Exploit likelihood
What each source reports
NVD Score used
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Cross-Domain Information Disclosure Vulnerability."
- Record
CVE-2009-1140- CVSS 2.0
- 7.1 High
AV:N/AC:M/Au:N/C:C/I:N/A:N - Weakness
- CWE-200
- Updated
- 2026-11-02
CVE List No score
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Cross-Domain Information Disclosure Vulnerability."
- Record
CVE-2009-1140- Updated
- 2026-11-02
EUVDEUVD-2009-1141 No score
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Cross-Domain Information Disclosure Vulnerability."
- Record
EUVD-2009-1141- Updated
- 2026-11-03
GitHub AdvisoriesGHSA-7vfc-h53m-93j3 No score
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for...
Microsoft Internet Explorer 5.01 SP4; 6 SP1; 6 and 7 for Windows XP SP2 and SP3; 6 and 7 for Server 2003 SP2; 7 for Vista Gold, SP1, and SP2; and 7 for Server 2008 SP2 does not prevent HTML rendering of cached content, which allows remote attackers to bypass the Same Origin Policy via unspecified vectors, aka "Cross-Domain Information Disclosure Vulnerability."
- Record
GHSA-7vfc-h53m-93j3- Weakness
- CWE-200
- Updated
- 2026-11-02
Affected products
Public exploits
Links only. Every CVE stores no exploit code.
| Source | Link | Date |
|---|---|---|
| Exploit-DB | Microsoft Internet Explorer 5.0.1 - Cached Content Cross Domain Information Disclosure | 2009-06-09 |
History
| Recorded | Changed | Sources |
|---|---|---|
| aliases | EUVD | |
| first indexed | CVE List, Exploit-DB, GitHub Advisories, NVD |
Dates are when Every CVE recorded each change. Upstream dates may differ.
In short
CVE-2009-1140 is a high vulnerability (CVSS 7.1) in Microsoft Internet Explorer, published June 10, 2009. Public exploit code exists. EPSS puts the chance of exploitation in the next 30 days at 24.8%, the 97th percentile. No source names a fixed version.
References
vupen.com/english/advisories/2009/1538
docs.microsoft.com/en-us/security-updates/securitybulletins/2009/ms09-019
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A6278
us-cert.gov/cas/techalerts/TA09-160A.html
securitytracker.com/id?1022350
nvd.nist.gov/vuln/detail/CVE-2009-1140
github.com/advisories/GHSA-7vfc-h53m-93j3