Skip to content
Fencer Vulns
medium 4.3

CVE-2007-3670 json

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered…

published 2007-07-10 19 y ago modified 2026-06-16 4 mo ago also EUVD-2007-3654

cvss
4.3
version 2.0, NVD
cisa kev
Not listed
not in CISA's catalog
epss
29.4%
EPSS 29.4% chance of exploitation in 30 days, percentile 98%
public exploits
1
Exploit-DB

Summary

Argument injection vulnerability in Microsoft Internet Explorer, when running on systems with Firefox installed and certain URIs registered, allows remote attackers to conduct cross-browser scripting attacks and execute arbitrary commands via shell metacharacters in a (1) FirefoxURL or (2) FirefoxHTML URI, which are inserted into the command line that is created when invoking firefox.exe. NOTE: it has been debated as to whether the issue is in Internet Explorer or Firefox. As of 20070711, it is CVE's opinion that IE appears to be failing to properly delimit the URL argument when invoking Firefox, and this issue could arise with other protocol handlers in IE as well. However, Mozilla has stated that it will address the issue with a "defense in depth" fix that will "prevent IE from sending Firefox malicious data."

Patch / fix

  • firefox-esr openSUSE Tumbleweed 128.5.1-1.1
  • MozillaFirefox openSUSE Tumbleweed 92.0-1.2
  • MozillaThunderbird openSUSE Tumbleweed 91.1.1-1.1

opensuse advisories openSUSE-SU-2024:14572-1openSUSE-SU-2024:10600-1openSUSE-SU-2024:10601-1

Timeline

  1. First public exploit (EDB-30285)
  2. Published

Exploit prediction

29.35% chance of exploitation in the next 30 days, higher than 98% of all scored CVEs (FIRST EPSS, 2026-11-08).

Exploits and checks

  • EDB-30285 Microsoft Internet Explorer and Mozilla Firefox - URI Handler Command Injection remote, 2007-07-10

CVSS scores

assigned by version score vector
NVD 2.0 4.3 AV:N/AC:M/Au:N/C:N/I:P/A:N

Classification

Weakness
  • CWE-79 Improper Neutralization of Input During Web Page Generation

References

Sources

Fencer Vulns keeps one entry per vulnerability: the CVE id wins, then GHSA, and records that alias each other are merged, except that two CVEs always keep separate entries. The same data is available as JSON.