Strix
26.1K

CVE-2007-4901

UnknownEPSS 2.79%

Last modified

CVE-2007-4901 is a vulnerability of currently unknown severity. The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.. EPSS estimates a 2.79% chance of exploitation in the next 30 days.

Description

The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.

Metrics

EPSS Probability
2.79%

84.6th percentile

Probability of exploitation in the next 30 days. Learn more

Affected Software

VendorProductVersions
AolAim LiteAll versions
AolAim ProAll versions
AolInstant Messenger6.2.32.1

References

Timeline

Published
Last Modified
Status
Modified

Frequently Asked Questions

What is CVE-2007-4901?
The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.
How severe is CVE-2007-4901?
Severity scoring for CVE-2007-4901 is pending analysis. The EPSS model estimates a 2.79% probability of exploitation in the next 30 days.
How do I fix CVE-2007-4901?
Check the vendor references and advisories linked above for patched versions and mitigation guidance. You can also run a Strix scan to test if your systems are affected.

Are you affected by CVE-2007-4901?

Run a free Strix scan to check your systems for this vulnerability.

Scan your code now

Source: NVD / NIST