CVE-2007-3406: Path Traversal
Multiple absolute path traversal vulnerabilities in Microsoft Internet Explorer 6 on Windows XP SP2 allow remote attackers to access arbitrary local files via the file: URI in the (1) src attribute of a (a) bgsound, (b) input, (c) EMBED, (d) img, or (e) script tag; (2) data attribute of an object tag; (3) value attribute of a param tag; (4) background attribute of a body tag; or (5) the background:url attribute declared in the BODY parameter of a STYLE tag.
Affected Software
Event History
Frequently Asked Questions
What is the severity of CVE-2007-3406?
CVE-2007-3406 is classified as a critical vulnerability due to its potential for remote exploitation leading to unauthorized file access.
How do I fix CVE-2007-3406?
To mitigate CVE-2007-3406, users should upgrade to a more secure version of Internet Explorer or apply any relevant security updates provided by Microsoft.
What are the affected versions for CVE-2007-3406?
CVE-2007-3406 primarily affects Microsoft Internet Explorer version 6 running on Windows XP Service Pack 2.
Can CVE-2007-3406 be exploited remotely?
Yes, CVE-2007-3406 can be exploited remotely by attackers through crafted web pages that leverage the file: URI scheme.
What types of tags are involved in CVE-2007-3406?
CVE-2007-3406 involves multiple HTML tags including bgsound, input, EMBED, img, and script tags that can be manipulated to perform path traversal.