CVE-2007-2225
Status: ModifiedMedium (4.3)—
A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka "URL Parsing Cross Domain Information Disclosure Vulnerability."
CVSS
- Version: 2.0
- Vector: AV:N/AC:M/Au:N/C:P/I:N/A:N
- Base score: 4.3
Exploitation probability (EPSS)
- Probability of exploitation in the next 30 days: 25%
- Percentile among all scored CVEs: 98
- Score date: 10/3/2026
EPSS (Exploit Prediction Scoring System, FIRST) estimates how likely a vulnerability is to be exploited in the wild within 30 days. It complements CVSS (impact) and CISA KEV (confirmed exploitation).
Affected technologies (2)
CWEs
- NVD-CWE-Other
References
- http://archive.openmya.devnull.jp/2007.06/msg00060.html
- http://openmya.hacker.jp/hasegawa/security/ms07-034.txt
- http://osvdb.org/35345
- http://secunia.com/advisories/25639
- http://www.kb.cert.org/vuls/id/682825
- http://www.securityfocus.com/archive/1/471947/100/0/threaded
- http://www.securityfocus.com/archive/1/472002/100/0/threaded
- http://www.securityfocus.com/bid/24392
- http://www.securitytracker.com/id?1018231
- http://www.securitytracker.com/id?1018232
- http://www.us-cert.gov/cas/techalerts/TA07-163A.html
- http://www.vupen.com/english/advisories/2007/2154
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045
- http://archive.openmya.devnull.jp/2007.06/msg00060.html
- http://openmya.hacker.jp/hasegawa/security/ms07-034.txt
- http://osvdb.org/35345
- http://secunia.com/advisories/25639
- http://www.kb.cert.org/vuls/id/682825
- http://www.securityfocus.com/archive/1/471947/100/0/threaded
- http://www.securityfocus.com/archive/1/472002/100/0/threaded
- http://www.securityfocus.com/bid/24392
- http://www.securitytracker.com/id?1018231
- http://www.securitytracker.com/id?1018232
- http://www.us-cert.gov/cas/techalerts/TA07-163A.html
- http://www.vupen.com/english/advisories/2007/2154
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045
Raw JSON (NVD)
Show
{
"id": "CVE-2007-2225",
"cveTags": [],
"metrics": {
"cvssMetricV2": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"cvssData": {
"version": "2.0",
"baseScore": 4.3,
"accessVector": "NETWORK",
"vectorString": "AV:N/AC:M/Au:N/C:P/I:N/A:N",
"authentication": "NONE",
"integrityImpact": "NONE",
"accessComplexity": "MEDIUM",
"availabilityImpact": "NONE",
"confidentialityImpact": "PARTIAL"
},
"acInsufInfo": false,
"impactScore": 2.9,
"baseSeverity": "MEDIUM",
"obtainAllPrivilege": false,
"exploitabilityScore": 8.6,
"obtainUserPrivilege": false,
"obtainOtherPrivilege": false,
"userInteractionRequired": true
}
]
},
"affected": [
{
"source": "secure@microsoft.com",
"affectedData": [
{
"vendor": "n/a",
"product": "n/a",
"versions": [
{
"status": "affected",
"version": "n/a"
}
]
}
]
}
],
"published": "2007-06-12T20:30:00.000",
"references": [
{
"url": "http://archive.openmya.devnull.jp/2007.06/msg00060.html",
"source": "secure@microsoft.com"
},
{
"url": "http://openmya.hacker.jp/hasegawa/security/ms07-034.txt",
"source": "secure@microsoft.com"
},
{
"url": "http://osvdb.org/35345",
"source": "secure@microsoft.com"
},
{
"url": "http://secunia.com/advisories/25639",
"source": "secure@microsoft.com"
},
{
"url": "http://www.kb.cert.org/vuls/id/682825",
"tags": [
"US Government Resource"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/archive/1/471947/100/0/threaded",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/archive/1/472002/100/0/threaded",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securityfocus.com/bid/24392",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securitytracker.com/id?1018231",
"source": "secure@microsoft.com"
},
{
"url": "http://www.securitytracker.com/id?1018232",
"source": "secure@microsoft.com"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA07-163A.html",
"tags": [
"US Government Resource"
],
"source": "secure@microsoft.com"
},
{
"url": "http://www.vupen.com/english/advisories/2007/2154",
"source": "secure@microsoft.com"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034",
"source": "secure@microsoft.com"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045",
"source": "secure@microsoft.com"
},
{
"url": "http://archive.openmya.devnull.jp/2007.06/msg00060.html",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://openmya.hacker.jp/hasegawa/security/ms07-034.txt",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://osvdb.org/35345",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://secunia.com/advisories/25639",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.kb.cert.org/vuls/id/682825",
"tags": [
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/471947/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/archive/1/472002/100/0/threaded",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securityfocus.com/bid/24392",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1018231",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.securitytracker.com/id?1018232",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.us-cert.gov/cas/techalerts/TA07-163A.html",
"tags": [
"US Government Resource"
],
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "http://www.vupen.com/english/advisories/2007/2154",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-034",
"source": "af854a3a-2127-422b-91ae-364da2661108"
},
{
"url": "https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A2045",
"source": "af854a3a-2127-422b-91ae-364da2661108"
}
],
"vulnStatus": "Modified",
"weaknesses": [
{
"type": "Primary",
"source": "nvd@nist.gov",
"description": [
{
"lang": "en",
"value": "NVD-CWE-Other"
}
]
}
],
"descriptions": [
{
"lang": "en",
"value": "A component in Microsoft Outlook Express 6 and Windows Mail in Windows Vista does not properly handle certain HTTP headers when processing MHTML protocol URLs, which allows remote attackers to obtain sensitive information from other Internet Explorer domains, aka \"URL Parsing Cross Domain Information Disclosure Vulnerability.\""
},
{
"lang": "es",
"value": "Un componente en Microsoft Outlook Express 6 y windows Mail en Windows Vista no maneja adecuadamente determinadas cabeceras HTTP cuado procesa URLs del protocolo MHTML, lo cual permite a atacantes remotos obtener información sensible de ostros dominios de Internet Explorer, también conocida como \"Vulnerabilidad de revelación de información de dominios cruzados en el análisis URL\" (URL Parsing Cross Domain Information Disclosure Vulnerability)."
}
],
"lastModified": "2026-06-16T22:39:10.473",
"configurations": [
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:*:x64:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "CD264C73-360E-414D-BE22-192F92E5A0A3"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:*:sp2:x64:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "6881476D-81A2-4DFD-AC77-82A8D08A0568"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:sp1:*:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "644E2E89-F3E3-4383-B460-424D724EE62F"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:sp1:*:itanium:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "7D11FC8D-59DD-4CAC-B4D3-DABB7A9903F1"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_2003_server:sp2:*:itanium:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D21D1DFE-F61B-407E-A945-4F42F86947B0"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:*:professional_x64:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "E0BBA081-24D5-4990-882F-69CB05CC28CF"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "9B339C33-8896-4896-88FF-88E74FDBC543"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_xp:*:sp2:professional_x64:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "1AB9988B-5A9C-4F6D-BCCC-4D03AC6E4CF9"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:outlook_express:6.0:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "85FD3557-956D-4A96-8AA5-5FD9DB87FD11"
}
],
"operator": "OR"
}
],
"operator": "AND"
},
{
"nodes": [
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:o:microsoft:windows_vista:*:gold:*:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "D34A558F-A656-43EB-AC52-C3710F77CDD8"
},
{
"criteria": "cpe:2.3:o:microsoft:windows_vista:*:gold:x64:*:*:*:*:*",
"vulnerable": false,
"matchCriteriaId": "F9DC56EB-EDC4-4DFE-BA9B-B17FF4A91734"
}
],
"operator": "OR"
},
{
"negate": false,
"cpeMatch": [
{
"criteria": "cpe:2.3:a:microsoft:windows_mail:*:*:*:*:*:*:*:*",
"vulnerable": true,
"matchCriteriaId": "0BDD015F-267D-4E33-885B-6A14F493CCC5"
}
],
"operator": "OR"
}
],
"operator": "AND"
}
],
"sourceIdentifier": "secure@microsoft.com"
}