PT-2007-5654 · Microsoft · Internet Explorer

Published 2007-08-22 · Updated 2021-07-23 · CVE-2007-4478

Positive Technologies (AI Summary)

CVSS v2.0

4.3

Medium

Base vector

AV:N/AC:M/Au:N/C:N/I:P/A:N

Name of the Vulnerable Software and Affected Versions Microsoft Internet Explorer versions 6.0 through 7.0

Description A cross-site scripting issue allows remote attackers to inject arbitrary web script or HTML in the local zone via a URI. This occurs when the document at the associated URL is saved to a local file, which then contains the URI string along with the document's original content.

Recommendations For Microsoft Internet Explorer versions 6.0 through 7.0, consider disabling the ability to save documents from URLs to local files as a temporary workaround until a patch is available. Restrict access to local files that may contain URI strings to minimize the risk of exploitation.

Fix

Related Identifiers

CVE-2007-4478

Affected Products

Internet Explorer

References · 8

• https://nvd.nist.gov/vuln/detail/CVE-2007-4478 · Security Note
• http://securityfocus.com/archive/1/498684/100/0/threaded · Note
• http://osvdb.org/45826 · Note
• http://securityvulns.com/news/Microsoft/IE/saved-css.html · Note
• http://securityfocus.com/archive/1/498697/100/0/threaded · Note
• http://securityfocus.com/archive/1/477253/100/0/threaded · Note
• http://securityvulns.ru/Rdocument865.html · Note
• http://websecurity.com.ua/1241 · Note