cbcvebase.
CVE-2007-1499
published 2007-03-17

CVE-2007-1499: Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI…

PriorityP424medium4.3CVSS 2.0
AVNACMAuNCNIPAN
EXPLOIT
EPSS
29.78%
98.0th percentile
Microsoft Internet Explorer 7.0 on Windows XP and Vista allows remote attackers to conduct phishing attacks and possibly execute arbitrary code via a res: URI to navcancl.htm with an arbitrary URL as an argument, which displays the URL in the location bar of the "Navigation Canceled" page and injects the script into the "Refresh the page" link, aka Navigation Cancel Page Spoofing Vulnerability."

Affected

1 ranges
VendorProductVersion rangeFixed in
microsoftie——

Detection & IOCsextracted from sources · hover to see the quote

urlres://ieframe.dll/navcancl.htm#http://www.example.com/[script]↗
pathres://ieframe.dll/navcancl.htm↗
filenamenavcancl.htm↗
  • →Monitor for navigation to res://ieframe.dll/navcancl.htm with a URL fragment containing script content, which is the attack vector for this XSS/spoofing vulnerability. ↗
  • →Alert on use of the res: URI scheme targeting navcancl.htm with an arbitrary URL argument, as this is used to spoof the IE7 Navigation Canceled page and inject script into the 'Refresh the page' link. ↗
  • →Watch for theft of cookie-based authentication credentials following exploitation of this XSS vulnerability in IE7 on Windows XP and Vista. ↗
  • ·Vulnerability is specific to Microsoft Internet Explorer 7.0 on Windows XP and Vista; other versions or platforms are not affected. ↗
CVEs like this are exactly what “Exploited This Week” covers.

Every Monday: what got weaponized or added to CISA KEV in the last seven days — each CVE cross-linked to its PoC, Nuclei template, and detection rule. Free, one email a week, unsubscribe in one click.