CVE-2007-3033

Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zone.

CVSS v2.0 4.3 MEDIUM

4.3^/10

CVSS v2.0 : MEDIUM

Vector : AV:N/AC:M/Au:N/C:N/I:P/A:N

Exploitability : 8.6 / Impact : 2.9

Access Vector NETWORK

Access Complexity MEDIUM

Authentication NONE

Confidentiality Impact NONE

Integrity Impact PARTIAL

Availability Impact NONE

References

Link	Resource
http://www.securityfocus.com/bid/25287	Patch
http://www.securitytracker.com/id?1018566
http://secunia.com/advisories/26439	Patch Vendor Advisory
http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=575
http://www.us-cert.gov/cas/techalerts/TA07-226A.html	US Government Resource
http://www.kb.cert.org/vuls/id/558648	US Government Resource
http://www.vupen.com/english/advisories/2007/2872	Vendor Advisory
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2152
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-048

Advertisement

Configurations

Configuration 1 (hide)

OR	cpe:2.3:o:microsoft:windows_vista::::::::
	cpe:2.3:o:microsoft:windows_vista:::x64:::::*

Information

Published : 2007-08-14 15:17

Updated : 2018-10-12 14:43

NVD link : CVE-2007-3033

Mitre link : CVE-2007-3033

JSON object : View

CWE

CWE-79

Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')

Advertisement

Products Affected

microsoft

windows_vista

{"cve": {"data_type": "CVE", "references": {"reference_data": [{"url": "http://www.securityfocus.com/bid/25287", "name": "25287", "tags": ["Patch"], "refsource": "BID"}, {"url": "http://www.securitytracker.com/id?1018566", "name": "1018566", "tags": [], "refsource": "SECTRACK"}, {"url": "http://secunia.com/advisories/26439", "name": "26439", "tags": ["Patch", "Vendor Advisory"], "refsource": "SECUNIA"}, {"url": "http://labs.idefense.com/intelligence/vulnerabilities/display.php?id=575", "name": "20070814 Microsoft Windows Vista Sidebar RSS Feeds Gadget Cross Site Scripting Vulnerability", "tags": [], "refsource": "IDEFENSE"}, {"url": "http://www.us-cert.gov/cas/techalerts/TA07-226A.html", "name": "TA07-226A", "tags": ["US Government Resource"], "refsource": "CERT"}, {"url": "http://www.kb.cert.org/vuls/id/558648", "name": "VU#558648", "tags": ["US Government Resource"], "refsource": "CERT-VN"}, {"url": "http://www.vupen.com/english/advisories/2007/2872", "name": "ADV-2007-2872", "tags": ["Vendor Advisory"], "refsource": "VUPEN"}, {"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2152", "name": "oval:org.mitre.oval:def:2152", "tags": [], "refsource": "OVAL"}, {"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-048", "name": "MS07-048", "tags": [], "refsource": "MS"}]}, "data_format": "MITRE", "description": {"description_data": [{"lang": "en", "value": "Cross-site scripting (XSS) vulnerability in Windows Vista Feed Headlines Gadget (aka Sidebar RSS Feeds Gadget) in Windows Vista allows user-assisted remote attackers to execute arbitrary code via an RSS feed with crafted HTML attributes, which are not properly removed and are rendered in the local zone."}]}, "problemtype": {"problemtype_data": [{"description": [{"lang": "en", "value": "CWE-79"}]}]}, "data_version": "4.0", "CVE_data_meta": {"ID": "CVE-2007-3033", "ASSIGNER": "secure@microsoft.com"}}, "impact": {"baseMetricV2": {"cvssV2": {"version": "2.0", "baseScore": 4.3, "accessVector": "NETWORK", "vectorString": "AV:N/AC:M/Au:N/C:N/I:P/A:N", "authentication": "NONE", "integrityImpact": "PARTIAL", "accessComplexity": "MEDIUM", "availabilityImpact": "NONE", "confidentialityImpact": "NONE"}, "severity": "MEDIUM", "impactScore": 2.9, "obtainAllPrivilege": false, "exploitabilityScore": 8.6, "obtainUserPrivilege": false, "obtainOtherPrivilege": false, "userInteractionRequired": true}}, "publishedDate": "2007-08-14T22:17Z", "configurations": {"nodes": [{"children": [], "operator": "OR", "cpe_match": [{"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:*:*:*:*:*:*:*", "cpe_name": [], "vulnerable": true}, {"cpe23Uri": "cpe:2.3:o:microsoft:windows_vista:*:*:x64:*:*:*:*:*", "cpe_name": [], "vulnerable": true}]}], "CVE_data_version": "4.0"}, "lastModifiedDate": "2018-10-12T21:43Z"}