CVE-2001-0664 in the critical feed json
Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses…
published 2001-10-30 25 y ago modified 2026-06-16 4 mo ago also EUVD-2001-0650
- cvss
- 7.5
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 18.2%
- EPSS 18.2% chance of exploitation in 30 days, percentile 97%
- public exploits
- 1
- Exploit-DB
Summary
Internet Explorer 5.5 and 5.01 allows remote attackers to bypass security restrictions via malformed URLs that contain dotless IP addresses, which causes Internet Explorer to process the page in the Intranet Zone, which may have fewer security restrictions, aka the "Zone Spoofing vulnerability."
Timeline
- First public exploit (EDB-21118)
- Published
Exploit prediction
18.19% chance of exploitation in the next 30 days, higher than 97% of all scored CVEs (FIRST EPSS, 2026-11-08).
Exploits and checks
- EDB-21118 Microsoft Internet Explorer 5 - Zone Spoofing (MS01-055) remote, 2001-10-10
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 7.5 | AV:N/AC:L/Au:N/C:P/I:P/A:P |
References
-
docs.microsoft.com
/en-us/security-updates/securitybulletins/2001/ms01-051
vendor-advisory
- morph3us.org /blog/?p=31
-
marc.info
/?l=bugtraq&m=100281551611595&w=2
mailing-list
-
osvdb.org
/1971
vdb-entry
-
exchange.xforce.ibmcloud.com
/vulnerabilities/7258
vdb-entry
-
securityfocus.com
/bid/3420
vdb-entry
Sources
- CVE List CVE-2001-0664
- NVD CVE-2001-0664
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.