{"api_version":"1","generated_at":"2026-07-23T23:05:04+00:00","cve":"CVE-2007-0939","urls":{"html":"https://cve.report/CVE-2007-0939","api":"https://cve.report/api/cve/CVE-2007-0939.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-0939","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-0939"},"summary":{"title":"CVE-2007-0939","description":"Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka \"Cross-site Scripting and Spoofing Vulnerability.\"","state":"PUBLISHED","assigner":"microsoft","published_at":"2007-04-10 21:19:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://www.vupen.com/english/advisories/2007/1322","name":"http://www.vupen.com/english/advisories/2007/1322","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/22860","name":"http://www.securityfocus.com/bid/22860","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Content Management Server Cross-Site Scripting Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1575","name":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1575","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Repository  /  Oval Repository","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.osvdb.org/34007","name":"http://www.osvdb.org/34007","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/archive/1/466331/100/200/threaded","name":"http://www.securityfocus.com/archive/1/466331/100/200/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/24819","name":"http://secunia.com/advisories/24819","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Content Management Server Two Vulnerabilities - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securitytracker.com/id?1017894","name":"http://www.securitytracker.com/id?1017894","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Content Management Server Permits Cross-Site Scripting Attacks and Lets Remote Users Execute Arbitrary Code - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-018","name":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-018","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Microsoft Security Bulletin MS07-018 - Critical | Microsoft Docs","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-0939","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-0939","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"939","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"content_management_server","cpe6":"2001","cpe7":"sp1","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"939","vulnerable":"1","versionEndIncluding":"","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"microsoft","cpe5":"content_management_server","cpe6":"2002","cpe7":"sp2","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T12:34:21.387Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"HPSBST02208","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://www.securityfocus.com/archive/1/466331/100/200/threaded"},{"name":"ADV-2007-1322","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/1322"},{"name":"1017894","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://www.securitytracker.com/id?1017894"},{"name":"34007","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://www.osvdb.org/34007"},{"name":"MS07-018","tags":["vendor-advisory","x_refsource_MS","x_transferred"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-018"},{"name":"24819","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/24819"},{"name":"22860","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/22860"},{"name":"SSRT071365","tags":["vendor-advisory","x_refsource_HP","x_transferred"],"url":"http://www.securityfocus.com/archive/1/466331/100/200/threaded"},{"name":"oval:org.mitre.oval:def:1575","tags":["vdb-entry","signature","x_refsource_OVAL","x_transferred"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1575"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-04-10T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka \"Cross-site Scripting and Spoofing Vulnerability.\""}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-16T14:57:01.000Z","orgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","shortName":"microsoft"},"references":[{"name":"HPSBST02208","tags":["vendor-advisory","x_refsource_HP"],"url":"http://www.securityfocus.com/archive/1/466331/100/200/threaded"},{"name":"ADV-2007-1322","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/1322"},{"name":"1017894","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://www.securitytracker.com/id?1017894"},{"name":"34007","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://www.osvdb.org/34007"},{"name":"MS07-018","tags":["vendor-advisory","x_refsource_MS"],"url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-018"},{"name":"24819","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/24819"},{"name":"22860","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/22860"},{"name":"SSRT071365","tags":["vendor-advisory","x_refsource_HP"],"url":"http://www.securityfocus.com/archive/1/466331/100/200/threaded"},{"name":"oval:org.mitre.oval:def:1575","tags":["vdb-entry","signature","x_refsource_OVAL"],"url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1575"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"secure@microsoft.com","ID":"CVE-2007-0939","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka \"Cross-site Scripting and Spoofing Vulnerability.\""}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"HPSBST02208","refsource":"HP","url":"http://www.securityfocus.com/archive/1/466331/100/200/threaded"},{"name":"ADV-2007-1322","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/1322"},{"name":"1017894","refsource":"SECTRACK","url":"http://www.securitytracker.com/id?1017894"},{"name":"34007","refsource":"OSVDB","url":"http://www.osvdb.org/34007"},{"name":"MS07-018","refsource":"MS","url":"https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-018"},{"name":"24819","refsource":"SECUNIA","url":"http://secunia.com/advisories/24819"},{"name":"22860","refsource":"BID","url":"http://www.securityfocus.com/bid/22860"},{"name":"SSRT071365","refsource":"HP","url":"http://www.securityfocus.com/archive/1/466331/100/200/threaded"},{"name":"oval:org.mitre.oval:def:1575","refsource":"OVAL","url":"https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1575"}]}}}},"cveMetadata":{"assignerOrgId":"f38d906d-7342-40ea-92c1-6c4a2c6478c8","assignerShortName":"microsoft","cveId":"CVE-2007-0939","datePublished":"2007-04-10T21:00:00.000Z","dateReserved":"2007-02-14T00:00:00.000Z","dateUpdated":"2024-08-07T12:34:21.387Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-04-10 21:19:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:content_management_server:2001:sp1:*:*:*:*:*:*","matchCriteriaId":"307A2076-1512-4A42-94D9-1E90593F0FFF"},{"vulnerable":true,"criteria":"cpe:2.3:a:microsoft:content_management_server:2002:sp2:*:*:*:*:*:*","matchCriteriaId":"9A03DF01-2911-45EA-B6EB-898B96DA8A91"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"939","Ordinal":"1","Title":"CVE-2007-0939","CVE":"CVE-2007-0939","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"939","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in Microsoft Content Management Server (MCMS) 2001 SP1 and 2002 SP2 allows remote attackers to inject arbitrary web script or HTML via unspecified vectors involving HTML redirection queries, aka \"Cross-site Scripting and Spoofing Vulnerability.\"","Type":"Description","Title":"CVE-2007-0939"},{"CveYear":"2007","CveId":"939","Ordinal":"2","NoteData":"2007-04-10","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"939","Ordinal":"3","NoteData":"2018-10-16","Type":"Other","Title":"Modified"}]}}}