PT-2007-5654 · Microsoft · Internet Explorer

Publicado 2007-08-22 · Atualizado 2021-07-23 · CVE-2007-4478

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Média

Vetor base

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6.0 through 7.0

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML in the local zone via a URI. This occurs when the document at the associated URL is saved to a local file, which then contains the URI string along with the document's original content.

Recommendations For Microsoft Internet Explorer versions 6.0 through 7.0, consider disabling the ability to save documents from URLs to local files as a temporary workaround until a patch is available. Restrict access to local files that may contain URI strings to minimize the risk of exploitation.

Correção

Identificadores relacionados

CVE-2007-4478

Produtos afetados

Internet Explorer

Referências · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-4478 · Nota de Segurança
• http://securityfocus.com/archive/1/498684/100/0/threaded · Nota
• http://osvdb.org/45826 · Nota
• http://securityvulns.com/news/Microsoft/IE/saved-css.html · Nota
• http://securityfocus.com/archive/1/498697/100/0/threaded · Nota
• http://securityfocus.com/archive/1/477253/100/0/threaded · Nota
• http://securityvulns.ru/Rdocument865.html · Nota
• http://websecurity.com.ua/1241 · Nota