CVE-2007-1499 Cross-site scripting in n/a
Remote attackers can execute arbitrary code or conduct phishing via crafted res: URIs in Internet Explorer, requiring user interaction.
- Exploited in the wild
- Not known
- Login needed
- Not needed
- Attackable
- Over the internet
- Victim action needed
- A user has to click or open something
- Fix
- None listed
What is CVE-2007-1499?
CVE-2007-1499 is a medium-severity cross-site scripting vulnerability in Microsoft Ie, published on 17 Mar 2007. An attacker can exploit it over the internet without logging in, and only if a user opens a file or follows a link.
Official description
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."
Weakness: CWE-79
Which versions are affected by CVE-2007-1499?
It affects 1 product.
Products include Microsoft Ie.
How do I fix CVE-2007-1499?
No fix has been published for CVE-2007-1499 yet. Limit exposure of the affected software until one is available.
Escape output for the context it lands in and set a strict Content Security Policy. Upgrading the affected component is the real fix. More about Cross-site scripting.
Is CVE-2007-1499 being exploited?
It is not confirmed as exploited in the wild, but public exploit code for CVE-2007-1499 exists.
Public exploit code: 1 Exploit-DB entry.
Other vulnerabilities in Microsoft Ie
Sources
Also known as CVE-2007-1752, GHSA-cjh8-4rc2-q72f.