CVE-2007-4039

Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://larholm.com/2007/07/25/mozilla-protocol-abuse/
http://seclists.org/fulldisclosure/2007/Jul/0557.html

Configurations

Configuration 1 (hide)

cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*

History

No history.

Information

Published : 2007-07-27 22:30

Updated : 2023-12-10 10:40

NVD link : CVE-2007-4039

Mitre link : CVE-2007-4039

CVE.ORG link : CVE-2007-4039

JSON object : View

Products Affected

mozilla

mozilla

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

{"id": "CVE-2007-4039", "metrics": {"cvssMetricV2": [{"type": "Primary", "source": "nvd@nist.gov", "cvssData": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "acInsufInfo": false, "impactScore": 2.9, "baseSeverity": "MEDIUM", "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}]}, "published": "2007-07-27T22:30:00.000", "references": [{"url": "http://larholm.com/2007/07/25/mozilla-protocol-abuse/", "source": "cve@mitre.org"}, {"url": "http://seclists.org/fulldisclosure/2007/Jul/0557.html", "source": "cve@mitre.org"}], "vulnStatus": "Analyzed", "weaknesses": [{"type": "Primary", "source": "nvd@nist.gov", "description": [{"lang": "en", "value": "CWE-79"}]}], "descriptions": [{"lang": "en", "value": "Argument injection vulnerability involving Mozilla, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670."}, {"lang": "es", "value": "Vulnerabilidad de inyecci\u00f3n de argumento involucrando a Mozilla, cuando determinados URIS se han registrado, permite a atacantes remotos conducir ataques de salto de navegador y ejecutar comandos de su elecci\u00f3n mediante metacaracteres de consola de comandos en un URI no especificado, que son insertados en una l\u00ednea de comando al invocar al proceso gestor, asunto similar a CVE-2007-3670."}], "lastModified": "2008-09-05T04:00:00.000", "configurations": [{"nodes": [{"negate": false, "cpeMatch": [{"criteria": "cpe:2.3:a:mozilla:mozilla:*:*:*:*:*:*:*:*", "vulnerable": true, "matchCriteriaId": "10E59CDD-9F95-4E38-95B3-AC5C35075378"}], "operator": "OR"}]}], "vendorComments": [{"comment": "Not vulnerable. This issue does not affect the versions of Firefox or Thunderbird as shipped with Red Hat Enterprise Linux.", "lastModified": "2007-07-31T00:00:00", "organization": "Red Hat"}], "sourceIdentifier": "cve@mitre.org"}