CVE-2007-1009 json
Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verif…
published 2007-04-19 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-1006
- cvss
- 4.6
- version 2.0, NVD
- cisa kev
- Not listed
- not in CISA's catalog
- epss
- 0.3%
- EPSS 0.3% chance of exploitation in 30 days, percentile 24%
- public exploits
- 0
- none known
Summary
Macrovision InstallAnywhere Enterprise before 8.0.1 uses the InstallScript.iap_xml configuration file without integrity protection to verify authorization for installing an application, which allows local users to perform unauthorized installations by removing the (1) password or (2) serial number verification sections from this file.
Patch / fix
Exploit prediction
0.32% chance of exploitation in the next 30 days, higher than 24% of all scored CVEs (FIRST EPSS, 2026-11-08).
CVSS scores
| assigned by | version | score | vector |
|---|---|---|---|
| NVD | 2.0 | 4.6 | AV:L/AC:L/Au:N/C:P/I:P/A:P |
References
-
securityfocus.com
/bid/22643
vdb-entry, patch
-
symantec.com
/content/en/us/enterprise/research/SYMSA-2007-003.txt
vendor-advisory
-
securityreason.com
/securityalert/2596
third-party-advisory
-
vupen.com
/english/advisories/2007/1433
vdb-entry
-
securityfocus.com
/archive/1/466035/100/0/threaded
mailing-list
Sources
- CVE List CVE-2007-1009
- NVD CVE-2007-1009
Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.