CVE-2003-0814

Severity: high (CVSS 7.5 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 27.7% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-02-03 · updated 2026-06-16

Description

Internet Explorer 6 SP1 and earlier allows remote attackers to bypass zone restrictions and execute Javascript by setting the window's "href" to the malicious Javascript, then calling execCommand("Refresh") to refresh the page, aka BodyRefreshLoadsJPU or the "ExecCommand Cross Domain" vulnerability.

Affected products

Microsoft Ie: 6.0-sp1
Microsoft Internet Explorer 11: 5.0.1, 5.0.1-sp1, 5.0.1-sp2, 5.0.1-sp3, 5.5, 5.5-sp1 (+2)

References

http://secunia.com/advisories/10192
http://securitytracker.com/id?1007687
http://www.derkeiler.com/Mailing-Lists/securityfocus/bugtraq/2003-09/0177.html
http://www.kb.cert.org/vuls/id/326412
http://www.safecenter.net/liudieyu/BodyRefreshLoadsJPU/BodyRefreshLoadsJPU-Content.htm
http://www.securityfocus.com/archive/1/337086
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2003/ms03-048
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A335
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A341
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A342
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A343
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A344

Get alerted when CVE-2003-0814 or the next vulnerability affects your stack