CVE Vulnerability

CVE-2007-0047

CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.

6.8 /10

CVSS v2.0 :

V3 Legend

Vector :

Exploitability : 8.6 / Impact : 6.4

Attack Vector

Attack Complexity

Privileges Required

User Interaction

Confidentiality Impact PARTIAL

Integrity Impact PARTIAL

Availability Impact PARTIAL

Scope

References
Link Resource
http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf
http://securitytracker.com/id?1017469
http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html
http://secunia.com/advisories/23882
http://www.vupen.com/english/advisories/2007/0032
https://exchange.xforce.ibmcloud.com/vulnerabilities/31291
Configurations

Configuration 1

cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*
Information

Published : 2007-01-03 09:28

Updated : 2017-07-29 01:29

NVD link : CVE-2007-0047

Mitre link : CVE-2007-0047

Products Affected
No products.
CWE
NVD-CWE-Other