{"api_version":"1","generated_at":"2026-07-23T06:56:26+00:00","cve":"CVE-2007-0047","urls":{"html":"https://cve.report/CVE-2007-0047","api":"https://cve.report/api/cve/CVE-2007-0047.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-0047","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-0047"},"summary":{"title":"CVE-2007-0047","description":"CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-01-03 21:28:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"6.8","severity":"","vector":"AV:N/AC:M/Au:N/C:P/I:P/A:P","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"}}],"references":[{"url":"http://securitytracker.com/id?1017469","name":"http://securitytracker.com/id?1017469","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityTracker.com Archives - Adobe Acrobat Reader Plugin Bugs Let Remote Users Deny Service, Conduct Cross-Site Scripting Attacks, and Execute Arbitrary Code","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf","name":"http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"application/pdf","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31291","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31291","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/23882","name":"http://secunia.com/advisories/23882","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SUSE update for acroread - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html","name":"http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SuSE Security announcements: [suse-security-announce] SUSE Security Announcement: Acrobat Reader 7.0.9 (SUSE-SA:2007:011)","mime":"text/html","httpstatus":"404","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/0032","name":"http://www.vupen.com/english/advisories/2007/0032","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-0047","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-0047","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"47","vulnerable":"1","versionEndIncluding":"7.0.8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"adobe","cpe5":"acrobat_reader","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T12:03:36.988Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"adobe-acrobat-xmlhttp-response-splitting(31291)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31291"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf"},{"name":"23882","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/23882"},{"name":"ADV-2007-0032","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/0032"},{"name":"SUSE-SA:2007:011","tags":["vendor-advisory","x_refsource_SUSE","x_transferred"],"url":"http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html"},{"name":"1017469","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1017469"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-01-03T00:00:00.000Z","descriptions":[{"lang":"en","value":"CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2017-07-28T12:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"adobe-acrobat-xmlhttp-response-splitting(31291)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31291"},{"tags":["x_refsource_MISC"],"url":"http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf"},{"name":"23882","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/23882"},{"name":"ADV-2007-0032","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/0032"},{"name":"SUSE-SA:2007:011","tags":["vendor-advisory","x_refsource_SUSE"],"url":"http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html"},{"name":"1017469","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1017469"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-0047","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"adobe-acrobat-xmlhttp-response-splitting(31291)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/31291"},{"name":"http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf","refsource":"MISC","url":"http://events.ccc.de/congress/2006/Fahrplan/attachments/1158-Subverting_Ajax.pdf"},{"name":"23882","refsource":"SECUNIA","url":"http://secunia.com/advisories/23882"},{"name":"ADV-2007-0032","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/0032"},{"name":"SUSE-SA:2007:011","refsource":"SUSE","url":"http://lists.suse.com/archive/suse-security-announce/2007-Jan/0012.html"},{"name":"1017469","refsource":"SECTRACK","url":"http://securitytracker.com/id?1017469"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-0047","datePublished":"2007-01-03T20:00:00.000Z","dateReserved":"2007-01-03T00:00:00.000Z","dateUpdated":"2024-08-07T12:03:36.988Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-01-03 21:28:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:P/I:P/A:P","baseScore":6.8,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"PARTIAL","integrityImpact":"PARTIAL","availabilityImpact":"PARTIAL"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":6.4,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":true,"userInteractionRequired":false}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:adobe:acrobat_reader:*:*:*:*:*:*:*:*","versionEndIncluding":"7.0.8","matchCriteriaId":"FD055652-DA7A-4881-ACD3-9D491821DC73"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"47","Ordinal":"1","Title":"CVE-2007-0047","CVE":"CVE-2007-0047","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"47","Ordinal":"1","NoteData":"CRLF injection vulnerability in Adobe Acrobat Reader Plugin before 8.0.0, when used with the Microsoft.XMLHTTP ActiveX object in Internet Explorer, allows remote attackers to inject arbitrary HTTP headers and conduct HTTP response splitting attacks via CRLF sequences in the javascript: URI in the (1) FDF, (2) XML, or (3) XFDF AJAX request parameters.","Type":"Description","Title":"CVE-2007-0047"},{"CveYear":"2007","CveId":"47","Ordinal":"2","NoteData":"2007-01-03","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"47","Ordinal":"3","NoteData":"2017-07-28","Type":"Other","Title":"Modified"}]}}}