CVE-2007-4040
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670.
Vulnerabilidad de inyección de argumento involucrando a Microsoft Outlook y Outlook Express, cuando determinados URIS se han registrado, permite a atacantes remotos conducir ataques de salto de navegador y ejecutar comandos de su elección mediante metacaracteres de consola de comandos en un URI no especificado, que son insertados en una línea de comando al invocar al proceso gestor, asunto similar a CVE-2007-3670.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2007-07-27 CVE Reserved
- 2007-07-27 CVE Published
- 2024-09-17 CVE Updated
- 2024-09-17 EPSS Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-79: Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://larholm.com/2007/07/25/mozilla-protocol-abuse | X_refsource_misc | |
http://seclists.org/fulldisclosure/2007/Jul/0557.html | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Microsoft Search vendor "Microsoft" | Outlook Search vendor "Microsoft" for product "Outlook" | * | - |
Affected
| ||||||
Microsoft Search vendor "Microsoft" | Outlook Express Search vendor "Microsoft" for product "Outlook Express" | * | - |
Affected
|