CVE-2007-3896

Description

The URL handling in Shell32.dll in the Windows shell in Microsoft Windows XP and Server 2003, with Internet Explorer 7 installed, allows remote attackers to execute arbitrary programs via invalid % sequences in a mailto: or other URI handler, as demonstrated using mIRC, Outlook, Firefox, Adobe Reader, Skype, and other applications. NOTE: this issue might be related to other issues involving URL handlers in Windows systems, such as CVE-2007-3845. There also might be separate but closely related issues in the applications that are invoked by the handlers.

Risk Information

Base Score

8.4

MODERATE

Vector

AV:L/AC:L/PR:N/UI:N/S:U/C:H/I:H/A:H

EPSS Score

Exploitation Probability

83.481

Associated Vulnerability

Vulnerability	OS Platform
Security Update for Windows XP x64 Edition (KB943460)	Windows
Security Update for Windows XP (KB943460)	Windows
Security Update for Windows Server 2003 (KB943460) x86 based systems	Windows
Security Update for Windows Server 2003 (KB943460) x86 based systems for SP2	Windows

Patch Details

No records found

References

https://nvd.nist.gov/vuln/detail/CVE-2023-1234
https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-1234