$ cve CVE-2007-3670 JSON

CVE-2007-3670 EXPLOIT

4.3

MEDIUM · CVSS 2.0 · EPSS 29.4% (pctl 98)

Patch early

A public exploit exists.

Description

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."

Scoring

CVSS	4.3 (MEDIUM, v2.0)
Vector	AV:N/AC:M/Au:N/C:N/I:P/A:N
EPSS	29.36% — more likely to be exploited than 98% of all CVEs
Weakness	CWE-79
On CISA KEV	no
Public exploit	yes
Published	2007-07-10
Last modified	2026-06-16

Affected (2)

Vendor	Product
microsoft	internet explorer
mozilla	firefox

Public exploits

Source	Title	Date
exploit-db	Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection	2007-07-10

References

→ the Explorer · watch your stack · NVD