CVE-2003-1027

Severity: critical (CVSS 10.0 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 38.1% probability of exploitation in the next 30 days
Public exploit or detection template: none known
Published: 2004-01-20 · updated 2026-06-16

Description

Internet Explorer 5.01 through 6 SP1 allows remote attackers to direct drag and drop behaviors and other mouse click actions to other windows by using method caching (SaveRef) to access the window.moveBy method, which is otherwise inaccessible, as demonstrated by HijackClickV2, a different vulnerability than CVE-2003-0823, aka the "Function Pointer Drag and Drop Vulnerability."

Affected products

Microsoft Ie: 6.0-sp1
Microsoft Internet Explorer 11: 5.0, 5.0.1, 5.0.1-sp1, 5.0.1-sp2, 5.0.1-sp3, 5.5 (+3)

References

http://marc.info/?l=bugtraq&m=106979479719446&w=2
http://marc.info/?l=bugtraq&m=107038202225587&w=2
http://www.kb.cert.org/vuls/id/413886
http://www.safecenter.net/UMBRELLAWEBV4/HijackClickV2
http://www.securitytracker.com/id?1006036
http://www.us-cert.gov/cas/techalerts/TA04-033A.html
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-004
https://exchange.xforce.ibmcloud.com/vulnerabilities/13844
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A527
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A529
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A530
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A531

Get alerted when CVE-2003-1027 or the next vulnerability affects your stack