CVE-2008-3007

2008-09-1101:11:00

CWE-20

[email protected]

web.nvd.nist.gov

cve-2008-3007

uri handler

microsoft office

vulnerability

code execution

7.6 High

AI Score

Confidence

Low

9.3 High

CVSS2

Access Vector

NETWORK

Access Complexity

MEDIUM

Authentication

NONE

Confidentiality Impact

COMPLETE

Integrity Impact

COMPLETE

Availability Impact

COMPLETE

AV:N/AC:M/Au:N/C:C/I:C/A:C

0.868 High

EPSS

Percentile

98.6%

JSON

Argument injection vulnerability in a URI handler in Microsoft Office XP SP3, 2003 SP2 and SP3, 2007 Office System Gold and SP1, and Office OneNote 2007 Gold and SP1 allow remote attackers to execute arbitrary code via a crafted onenote:// URL, aka “Uniform Resource Locator Validation Error Vulnerability.”

CPENameOperatorVersion
microsoft:officemicrosoft officeeqxp
microsoft:officemicrosoft officeeq2003
microsoft:office_onenotemicrosoft office onenoteeq2007
microsoft:officemicrosoft officeeq2007

CPE	Name	Operator	Version
microsoft:office	microsoft office	eq	xp
microsoft:office	microsoft office	eq	2003
microsoft:office_onenote	microsoft office onenote	eq	2007
microsoft:office	microsoft office	eq	2007