CVE-2003-0907

Опубликовано: 01 июн. 2004

Источник: nvd

CVSS2: 5.1

EPSS Средний

Описание

Help and Support Center in Microsoft Windows XP SP1 does not properly validate HCP URLs, which allows remote attackers to execute arbitrary code via quotation marks in an hcp:// URL, which are not quoted when constructing the argument list to HelpCtr.exe.

Ссылки

http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020065.html
Broken Link
http://marc.info/?l=bugtraq&m=108196864221676&w=2
Third Party Advisory
http://www.ciac.org/ciac/bulletins/o-114.shtml
Broken Link
http://www.idefense.com/application/poi/display?id=100&type=vulnerabilities
Broken Link
http://www.kb.cert.org/vuls/id/260588
Patch
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/10119
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA04-104A.html
Broken Link
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15704
Third Party Advisory
VDB Entry
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1000
Broken Link
https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A904
Broken Link
http://lists.grok.org.uk/pipermail/full-disclosure/2004-April/020065.html
Broken Link
http://marc.info/?l=bugtraq&m=108196864221676&w=2
Third Party Advisory
http://www.ciac.org/ciac/bulletins/o-114.shtml
Broken Link
http://www.idefense.com/application/poi/display?id=100&type=vulnerabilities
Broken Link
http://www.kb.cert.org/vuls/id/260588
Patch
Third Party Advisory
US Government Resource
http://www.securityfocus.com/bid/10119
Broken Link
Third Party Advisory
VDB Entry
http://www.us-cert.gov/cas/techalerts/TA04-104A.html
Broken Link
Third Party Advisory
US Government Resource
https://docs.microsoft.com/en-us/security-updates/securitybulletins/2004/ms04-011
Patch
Vendor Advisory
https://exchange.xforce.ibmcloud.com/vulnerabilities/15704
Third Party Advisory
VDB Entry

Уязвимые конфигурации

Конфигурация 1

Одно из

cpe:2.3:o:microsoft:windows_server_2003:-:*:*:*:*:*:*:*

cpe:2.3:o:microsoft:windows_xp:-:*:*:*:*:*:*:*

EPSS

Процентиль: 97%

0.3377

Средний

5.1 Medium

CVSS2

Дефекты

CWE-88

Связанные уязвимости

GHSA-9h96-28m7-7h3g

github

почти 4 года назад