vulnwire
5.8med

CVE-2007-3164

Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the…

Published 19 y ago · modified 4 mo ago · JSON

CVSS
5.8
v2.0 · NVD
CISA KEV
No
not known exploited
EPSS
9.9%
percentile 96%
Public exploits
0
none known

Microsoft Internet Explorer 7, when prompting for HTTP Basic Authentication for an IDN web site, uses ACE labels for the domain name in the status bar, but uses internationalized labels for this name in the authentication dialog, which might allow remote attackers to perform phishing attacks if the user misinterprets confusable characters in the internationalized labels, as demonstrated by displaying xn--theshmogroup-bgk.com only in the status bar.

Exploit prediction (EPSS)

9.85% probability of exploitation in the next 30 days, higher than 96% of all scored CVEs.

CVSS scores

Assigned byVersionScoreVector
NVD2.05.8AV:N/AC:M/Au:N/C:P/I:P/A:N

References

  • secunia.com /advisories/25663 · third-party-advisory, x_refsource_SECUNIA, x_transferred
  • osvdb.org /36142 · vdb-entry, x_refsource_OSVDB, x_transferred
  • exchange.xforce.ibmcloud.com /vulnerabilities/34867 · vdb-entry, x_refsource_XF, x_transferred
  • securityfocus.com /bid/24483 · vdb-entry, x_refsource_BID, x_transferred
  • ha.ckers.org /blog/20070608/cross-domain-basic-auth-phishing-tactics/ · x_refsource_MISC, x_transferred
  • bitsploit.de /archives/428-Cross-Domain-Basic-Auth-Phishing-Tactics.html · x_refsource_MISC, x_transferred

Sources

vulnwire keeps one entry per vulnerability: the CVE id wins, then GHSA; records that alias each other are merged. Machine-readable: JSON.