Lucene search

MicrosoftCVE-2007-2225

HistoryJun 12, 2007 - 8:30 p.m.

CVE-2007-2225

2007-06-1220:30:00

microsoft

web.nvd.nist.gov

cve-2007-2225

microsoft

outlook express

windows mail

vulnerability

information disclosure

nvd

http

mhtml protocol

url parsing

CVSS2

4.3

Attack Vector

NETWORK

Attack Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

PARTIAL

Integrity Impact

NONE

Availability Impact

NONE

AV:N/AC:M/Au:N/C:P/I:N/A:N

AI Score

5.7

Confidence

Low

EPSS

0.119

Percentile

95.5%

JSON

A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka “URL Parsing Cross Domain Information Disclosure Vulnerability.”

Affected configurations

Nvd

Node

microsoftwindows_2003_serverx64

microsoftwindows_2003_serversp2x64

microsoftwindows_2003_serverMatchsp1

microsoftwindows_2003_serverMatchsp1itanium

microsoftwindows_2003_serverMatchsp2itanium

microsoftwindows_xpprofessional_x64

microsoftwindows_xpsp2

microsoftwindows_xpsp2professional_x64

AND

microsoftoutlook_expressMatch6.0

Node

microsoftwindows_vistagold

microsoftwindows_vistagoldx64

AND

microsoftwindows_mail

VendorProductVersionCPE
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*
microsoftwindows_2003_server*cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*
microsoftwindows_2003_serversp1cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*
microsoftwindows_2003_serversp1cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*
microsoftwindows_2003_serversp2cpe:2.3:o:microsoft:windows_2003_server:sp2:*:itanium:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:*:professional_x64:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*
microsoftwindows_xp*cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*
microsoftoutlook_express6.0cpe:2.3:a:microsoft:outlook_express:6.0:*:*:*:*:*:*:*
microsoftwindows_vista*cpe:2.3:o:microsoft:windows_vista:*:gold:*:*:*:*:*:*

Vendor	Product	Version	CPE
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server:::x64:::::*
microsoft	windows_2003_server	*	cpe:2.3:o:microsoft:windows_2003_server::sp2:x64:::::
microsoft	windows_2003_server	sp1	cpe:2.3:o:microsoft:windows_2003_server:sp1:::::::*
microsoft	windows_2003_server	sp1	cpe:2.3:o:microsoft:windows_2003_server:sp1::itanium:::::
microsoft	windows_2003_server	sp2	cpe:2.3:o:microsoft:windows_2003_server:sp2::itanium:::::
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp:::professional_x64:::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp2::::::*
microsoft	windows_xp	*	cpe:2.3:o:microsoft:windows_xp::sp2:professional_x64:::::
microsoft	outlook_express	6.0	cpe:2.3:a:microsoft:outlook_express:6.0:::::::*
microsoft	windows_vista	*	cpe:2.3:o:microsoft:windows_vista::gold::::::*