« Volver al listado

CVE-2007-5124

Estado: ModificadaMedia (6.8)—

The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message, related to AIM's filtering of "specific tags and attributes" and the lack of Local Machine Zone lockdown. NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901.

CVSS

Probabilidad de explotación (EPSS)

EPSS (Exploit Prediction Scoring System, de FIRST) estima la probabilidad de que una vulnerabilidad sea explotada en 30 días. Complementa a CVSS (impacto) y a CISA KEV (explotación confirmada).

Tecnologías afectadas (1)

AOL — Instant Messenger

CWE

Referencias

JSON original (NVD)

Mostrar
{
  "id": "CVE-2007-5124",
  "cveTags": [],
  "metrics": {
    "cvssMetricV2": [
      {
        "type": "Primary",
        "source": "nvd@nist.gov",
        "cvssData": {
          "version": "2.0",
          "baseScore": 6.8,
          "accessVector": "NETWORK",
          "vectorString": "AV:N/AC:M/Au:N/C:P/I:P/A:P",
          "authentication": "NONE",
          "integrityImpact": "PARTIAL",
          "accessComplexity": "MEDIUM",
          "availabilityImpact": "PARTIAL",
          "confidentialityImpact": "PARTIAL"
        },
        "acInsufInfo": false,
        "impactScore": 6.4,
        "baseSeverity": "MEDIUM",
        "obtainAllPrivilege": false,
        "exploitabilityScore": 8.6,
        "obtainUserPrivilege": true,
        "obtainOtherPrivilege": false,
        "userInteractionRequired": false
      }
    ]
  },
  "affected": [
    {
      "source": "cve@mitre.org",
      "affectedData": [
        {
          "vendor": "n/a",
          "product": "n/a",
          "versions": [
            {
              "status": "affected",
              "version": "n/a"
            }
          ]
        }
      ]
    }
  ],
  "published": "2007-09-27T19:17:00.000",
  "references": [
    {
      "url": "http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/480647/100/0/threaded",
      "source": "cve@mitre.org"
    },
    {
      "url": "http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    },
    {
      "url": "http://www.securityfocus.com/archive/1/480647/100/0/threaded",
      "source": "af854a3a-2127-422b-91ae-364da2661108"
    }
  ],
  "vulnStatus": "Modified",
  "weaknesses": [
    {
      "type": "Primary",
      "source": "nvd@nist.gov",
      "description": [
        {
          "lang": "en",
          "value": "CWE-94"
        }
      ]
    }
  ],
  "descriptions": [
    {
      "lang": "en",
      "value": "The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.5.3.12 and earlier allows remote attackers to execute arbitrary code via unspecified web script or HTML in an instant message, related to AIM's filtering of \"specific tags and attributes\" and the lack of Local Machine Zone lockdown.  NOTE: this issue reportedly exists because of an incomplete fix for CVE-2007-4901."
    },
    {
      "lang": "es",
      "value": "El control de Internet Explorer empotrado en AOL Instant Messenger (AIM) 6.5.3.12 y anteriores permite a atacantes remotos ejecutar código de su elección mediante secuencias de comandos web o HTML de su elección en un mensaje instantáneo, relacionado con el filtrado de AIM de \"etiquetas y atributos específicos\" y la falta de cierre de la Zona de la Máquina Local. NOTA: este asunto existe debido a un arreglo incompleto para CVE-2007-4901."
    }
  ],
  "lastModified": "2026-06-16T22:45:29.560",
  "configurations": [
    {
      "nodes": [
        {
          "negate": false,
          "cpeMatch": [
            {
              "criteria": "cpe:2.3:a:aol:instant_messenger:*:*:*:*:*:*:*:*",
              "vulnerable": true,
              "matchCriteriaId": "706075F5-512C-4BBF-BE19-CC435E3A7C78",
              "versionEndIncluding": "6.5.3.12"
            }
          ],
          "operator": "OR"
        }
      ]
    }
  ],
  "sourceIdentifier": "cve@mitre.org"
}