CVE-2007-4040

high · 8.8

Argument injection vulnerability involving Microsoft Outlook and Outlook Express, when certain URIs are registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in an unspecified URI, which are inserted into the command line when invoking the handling process, a similar issue to CVE-2007-3670.

8.8

CVSS

13.5%

EPSS (exploit prob.)

96th

EPSS percentile

2007-07-27

Published

CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Weaknesses

CWE-79

Affected products

Vendor	Product	Affected versions
microsoft	outlook	all versions
microsoft	outlook_express	all versions

Check a specific version with /api/v1/cve/match.

References

http://larholm.com/2007/07/25/mozilla-protocol-abuse/
http://seclists.org/fulldisclosure/2007/Jul/0557.html
http://larholm.com/2007/07/25/mozilla-protocol-abuse/
http://seclists.org/fulldisclosure/2007/Jul/0557.html

Query this programmatically:

curl https://evil-db.io/api/v1/cve/CVE-2007-4040