CVE-2007-1114
The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks,…
Does this matter?
EPSS puts the probability of exploitation in the next 30 days at 11.6%, higher than 96% of all known CVEs. Patch or mitigate before the next change window.
Description
The child frames in Microsoft Internet Explorer 7 inherit the default charset from the parent window when a charset is not specified in an HTTP Content-Type header or META tag, which allows remote attackers to conduct cross-site scripting (XSS) attacks, as demonstrated using the UTF-7 character set.
- CVSS 2.0
- 4.3 MEDIUMAV:N/AC:M/Au:N/C:N/I:P/A:N
- EPSS
- 11.61% probability · 96th percentile
- CISA KEV
- Not listed
- Affected
- microsoft/ie
- Source
- cve@mitre.org
References
- http://secunia.com/advisories/24314
- http://www.hardened-php.net/advisory_032007.142.htmlVendor Advisory
- http://www.osvdb.org/32119
- http://www.securityfocus.com/archive/1/461076/100/0/threaded
- http://www.securityfocus.com/bid/22701
- http://www.vupen.com/english/advisories/2007/0744
- http://secunia.com/advisories/24314
- http://www.hardened-php.net/advisory_032007.142.htmlVendor Advisory
- http://www.osvdb.org/32119
- http://www.securityfocus.com/archive/1/461076/100/0/threaded
- http://www.securityfocus.com/bid/22701
- http://www.vupen.com/english/advisories/2007/0744
Source: NVD record, EPSS from FIRST.org, KEV from CISA. Refreshed daily.