CVE-2007-5124
 
Severity Score
Exploit Likelihood
Affected Versions
Public Exploits
0Exploited in Wild
-Decision
Descriptions
The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message, related to AIM's filtering of "specific tags and attributes" and the lack of Local Machine Zone lockdown. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901.
El control de Internet Explorer empotrado en AOL Instant Messenger (AIM) 6.5.3.12 y anteriores permite a atacantes remotos ejecutar código de su elección mediante secuencias de comandos web o HTML de su elección en un mensaje instantáneo, relacionado con el filtrado de AIM de "etiquetas y atributos específicos" y la falta de cierre de la Zona de la Máquina Local. NOTA: este asunto existe debido a un arreglo incompleto para CVE-2007-4901.
CVSS Scores
SSVC
- Decision:-
Timeline
- 2007-09-27 CVE Reserved
- 2007-09-27 CVE Published
- 2024-06-23 EPSS Updated
- 2024-08-07 CVE Updated
- ---------- Exploited in Wild
- ---------- KEV Due Date
- ---------- First Exploit
CWE
- CWE-94: Improper Control of Generation of Code ('Code Injection')
CAPEC
References (2)
URL | Tag | Source |
---|---|---|
http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx | X_refsource_misc | |
http://www.securityfocus.com/archive/1/480647/100/0/threaded | Mailing List |
URL | Date | SRC |
---|
URL | Date | SRC |
---|
URL | Date | SRC |
---|
Affected Vendors, Products, and Versions
Vendor | Product | Version | Other | Status | ||||||
---|---|---|---|---|---|---|---|---|---|---|
Vendor | Product | Version | Other | Status | <-- --> | Vendor | Product | Version | Other | Status |
Aol Search vendor "Aol" | Instant Messenger Search vendor "Aol" for product "Instant Messenger" | <= 6.5.3.12 Search vendor "Aol" for product "Instant Messenger" and version " <= 6.5.3.12" | - |
Affected
|