CVE-2007-2292: microsoft internet_explorer Improper Input Validation

Modified

Published 26-04-2007Last modified 07-08-2024

Vulnerability summary

CVE-2007-2292 is a medium (CVSS 4.3) Improper Input Validation vulnerability in microsoft internet_explorer. EPSS estimates a 12.74% chance of exploitation in the next 30 days, higher than 96.2% of scored vulnerabilities.

Priority

Routine

Not severe (CVSS 4.3, network access); no exploitation reported by the 5 checked sources

Source freshness unavailable

How is this decided?

CVSS score

4.3/10

010

Medium · v2.0 (NVD)

EPSS score

12.74%

0%100%

Medium · 0.00 pp in 30 days

KEVNot listedNot listed by any tracked catalog.

RansomwareNot flaggedNo ransomware use recorded.

Public exploits0No public exploits recorded

Advisory lineage

Upstream 0 · Downstream 8

DSA-1392-1 DSA-1396-1 DSA-1401-1 DTSA-69-1 DTSA-80-1 RHSA-2007:0979+2 more

Timeline

26-04-2007
PublishedVulnerability first disclosed.
07-08-2024
Last modifiedVulnerability information updated.

Description

CRLF injection vulnerability in the Digest Authentication support for Mozilla Firefox before 2.0.0.8 and SeaMonkey before 1.1.5 allows remote attackers to conduct HTTP request splitting attacks via LF (%0a) bytes in the username attribute.

CVSS metrics

1 score · 1 source · 1 version

v2.04.3

EPSS trend

Probability

12.74%

Chance of exploitation in the next 30 days

Percentile

96%

Versus all other CVEs

30-day change

No change 0.00 pp

From 12.74% on 04-10-2026

04-10-202603-11-2026

Known exploited

Compare KEV catalogs

CISA KEV

Not in the CISA KEV catalog.

ENISA CNW

Not in the ENISA CNW catalog.

CIRCL

Not in the CIRCL catalog.

Public exploits

0 found

No public exploits indexed.

Weaknesses

CWE · root cause

CWE-20Improper Input ValidationThe product receives input or data, but it does not validate or incorrectly validates that the input has the properties that are required to process the data safely and correctly.

Affected systems

Version check

Known conditions: network-reachable, no authentication (CVSS vector). Other conditions: not stated in public data.

Mozilla2 products

firefox≤ 2.0.0.8
seamonkey≤ 1.1.5

Microsoft1 product

internet_explorerEOL7.0.5730.11

2 vendors · 3 products

References

52 links

www.redhat.com/archives/fedora-package-announce/2007-October/msg00285.htmlVendor AdvisoryX Refsource FEDORA
www.securityfocus.com/archive/1/482876/100/200/threadedMailing ListX Refsource BUGTRAQ
www.wisec.it/vulns.php?id=11X Refsource MISC
www.securitytracker.com/id?1017968VDB EntryX Refsource SECTRACK
www.vupen.com/english/advisories/2007/3587VDB EntryX Refsource VUPEN
secunia.com/advisories/27414Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/archive/1/482925/100/0/threadedMailing ListX Refsource BUGTRAQ
issues.rpath.com/browse/RPL-1858X Refsource CONFIRM
www.gentoo.org/security/en/glsa/glsa-200711-14.xmlVendor AdvisoryX Refsource GENTOO
secunia.com/advisories/27360Third Party AdvisoryX Refsource SECUNIA

Show all 52 references

h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=c00771742Vendor AdvisoryX Refsource HP
secunia.com/advisories/27298Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27315Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27327Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.vupen.com/english/advisories/2007/3544VDB EntryX Refsource VUPEN
secunia.com/advisories/27276Third Party AdvisoryX Refsource SECUNIAVendor Advisory
usn.ubuntu.com/535-1/Vendor AdvisoryX Refsource UBUNTU
www.debian.org/security/2007/dsa-1401Vendor AdvisoryX Refsource DEBIAN
www.debian.org/security/2007/dsa-1392Vendor AdvisoryX Refsource DEBIAN
www.redhat.com/support/errata/RHSA-2007-0980.htmlVendor AdvisoryX Refsource REDHAT
secunia.com/advisories/27383Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.novell.com/linux/security/advisories/2007_57_mozilla.htmlVendor AdvisoryX Refsource SUSE
secunia.com/advisories/27356Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-0981.htmlVendor AdvisoryX Refsource REDHAT
www.vupen.com/english/advisories/2008/0083VDB EntryX Refsource VUPEN
secunia.com/advisories/27387Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.securityfocus.com/bid/23668VDB EntryX Refsource BID
www.redhat.com/archives/fedora-package-announce/2007-November/msg00498.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/27403Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27336Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.debian.org/security/2007/dsa-1396Vendor AdvisoryX Refsource DEBIAN
www.mozilla.org/security/announce/2007/mfsa2007-31.htmlX Refsource CONFIRM
secunia.com/advisories/27425Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/28398Third Party AdvisoryX Refsource SECUNIA
exchange.xforce.ibmcloud.com/vulnerabilities/33981VDB EntryX Refsource XF
oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A10195VDB EntrySignatureX Refsource OVAL
secunia.com/advisories/27311Third Party AdvisoryX Refsource SECUNIAVendor Advisory
secunia.com/advisories/27325Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.mandriva.com/en/security/advisories?name=MDKSA-2007:202Vendor AdvisoryX Refsource MANDRIVA
secunia.com/advisories/27665Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/support/errata/RHSA-2007-0979.htmlVendor AdvisoryX Refsource REDHAT
www.securityfocus.com/archive/1/466906/100/0/threadedMailing ListX Refsource BUGTRAQ
secunia.com/advisories/27335Third Party AdvisoryX Refsource SECUNIAVendor Advisory
www.redhat.com/archives/fedora-package-announce/2007-October/msg00355.htmlVendor AdvisoryX Refsource FEDORA
secunia.com/advisories/27480Third Party AdvisoryX Refsource SECUNIAVendor Advisory
bugzilla.mozilla.org/show_bug.cgi?id=378787X Refsource MISC
secunia.com/advisories/27680Third Party AdvisoryX Refsource SECUNIA
securityreason.com/securityalert/2654Third Party AdvisoryX Refsource SREASON
support.novell.com/techcenter/psdb/60eb95b75c76f9fbfcc9a89f99cd8f79.htmlX Refsource CONFIRM
sunsolve.sun.com/search/document.do?assetkey=1-66-201516-1Vendor AdvisoryX Refsource SUNALERT
www.securityfocus.com/archive/1/482932/100/200/threadedMailing ListX Refsource BUGTRAQ
www.ubuntu.com/usn/usn-536-1Vendor AdvisoryX Refsource UBUNTU