CVEs-PoC/2016/CVE-2016-3321.md

### [CVE-2016-3321](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2016-3321)
![](https://img.shields.io/static/v1?label=Product&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Version&message=n%2Fa&color=blue)
![](https://img.shields.io/static/v1?label=Vulnerability&message=n%2Fa&color=brighgreen)

### Description

Microsoft Internet Explorer 10 and 11 load different files for attempts to open a file:// URL depending on whether the file exists, which allows local users to enumerate files via vectors involving a file:// URL and an HTML5 sandbox iframe, aka "Internet Explorer Information Disclosure Vulnerability."

### POC

#### Reference
- http://seclists.org/fulldisclosure/2016/Aug/44
- https://www.securify.nl/advisory/SFY20160301/internet_explorer_iframe_sandbox_local_file_name_disclosure_vulnerability.html

#### Github
No PoCs found on GitHub currently.