CVE-2007-4041 : Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0al

Multiple argument injection vulnerabilities in Mozilla Firefox 2.0.0.5 and 3.0alpha allow remote attackers to execute arbitrary commands via a NULL byte (%00) and shell metacharacters in a (1) mailto, (2) nntp, (3) news, (4) snews, or (5) telnet URI, a similar issue to CVE-2007-3670.

Published 2007-07-27 22:30:00

Updated 2021-07-23 15:04:56

Source MITRE

View at NVD, CVE.org

Products affected by CVE-2007-4041

Microsoft » Internet Explorer » Version: 7
cpe:2.3:a:microsoft:internet_explorer:7:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2 Datacenter Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Enterprise Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Standard Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Web Edition Edition
When used together with: Microsoft » Windows Xp » Update SP2 Home Edition Edition
When used together with: Microsoft » Windows Xp » Update SP2 Professional Edition Edition
Mozilla » Firefox » Version: 2.0.0.5
cpe:2.3:a:mozilla:firefox:2.0.0.5:*:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2 Datacenter Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Enterprise Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Standard Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Web Edition Edition
When used together with: Microsoft » Windows Xp » Update SP2 Home Edition Edition
When used together with: Microsoft » Windows Xp » Update SP2 Professional Edition Edition
Mozilla » Firefox » Version: 3.0 Update Alpha
cpe:2.3:a:mozilla:firefox:3.0:alpha:*:*:*:*:*:*
Matching versions
When used together with: Microsoft » Windows 2003 Server » Update SP2 Datacenter Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Enterprise Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Standard Edition Edition
When used together with: Microsoft » Windows 2003 Server » Update SP2 Web Edition Edition
When used together with: Microsoft » Windows Xp » Update SP2 Home Edition Edition
When used together with: Microsoft » Windows Xp » Update SP2 Professional Edition Edition

Exploit prediction scoring system (EPSS) score for CVE-2007-4041

EPSS FAQ

1.47%

Probability of exploitation activity in the next 30 days EPSS Score History

~ 86 %

Percentile, the proportion of vulnerabilities that are scored at or less

CVSS scores for CVE-2007-4041

Base Score	Base Severity	CVSS Vector	Exploitability Score	Impact Score	Score Source	First Seen
6.8	MEDIUM	AV:N/AC:M/Au:N/C:P/I:P/A:P	8.6	6.4	NIST
Access Vector: Network Access Complexity: Medium Authentication: None Confidentiality Impact: Partial Integrity Impact: Partial Availability Impact: Partial

CWE ids for CVE-2007-4041

CWE-78 Improper Neutralization of Special Elements used in an OS Command ('OS Command Injection')

The product constructs all or part of an OS command using externally-influenced input from an upstream component, but it does not neutralize or incorrectly neutralizes special elements that could modify the intended OS command when it is sent to a downstream component.

Assigned by: nvd@nist.gov (Primary)

References for CVE-2007-4041

Jump to

Vulnerability Details : CVE-2007-4041

Products affected by CVE-2007-4041

Exploit prediction scoring system (EPSS) score for CVE-2007-4041

CVSS scores for CVE-2007-4041

CWE ids for CVE-2007-4041

References for CVE-2007-4041