{"api_version":"1","generated_at":"2026-07-23T05:00:06+00:00","cve":"CVE-2007-3679","urls":{"html":"https://cve.report/CVE-2007-3679","api":"https://cve.report/api/cve/CVE-2007-3679.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-3679","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-3679"},"summary":{"title":"CVE-2007-3679","description":"The Citrix EPA ActiveX control (aka the \"endpoint checking control\" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-07-25 17:30:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["NVD-CWE-Other","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://secunia.com/advisories/26143","name":"http://secunia.com/advisories/26143","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"About Secunia Research | Flexera","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/474204/100/0/threaded","name":"http://www.securityfocus.com/archive/1/474204/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.vupen.com/english/advisories/2007/2583","name":"http://www.vupen.com/english/advisories/2007/2583","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.citrix.com/article/CTX114028","name":"http://support.citrix.com/article/CTX114028","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"CTX114028 - Hotfix AG2000_v455 Rev B - Access Gateway Standard Edition 4.5 - Citrix Knowledge Center","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/24865","name":"http://www.securityfocus.com/bid/24865","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Citrix EPA ActiveX Control Design Flaw","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"http://securityreason.com/securityalert/2916","name":"http://securityreason.com/securityalert/2916","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Citrix EPA ActiveX Control Design Flaw - CXSecurity.com","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://support.citrix.com/article/CTX113815","name":"http://support.citrix.com/article/CTX113815","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"CTX113815 - Vulnerabilities in Access Gateway Standard and Advanced Editions clients could result in arbitrary code execution - Citrix Knowledge Center","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35511","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35511","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt","name":"http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"symantec.com has moved to broadcom.com","mime":"text/html","httpstatus":"404","archivestatus":"404"},{"url":"http://osvdb.org/37845","name":"http://osvdb.org/37845","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.securityfocus.com/bid/24975","name":"http://www.securityfocus.com/bid/24975","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-3679","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-3679","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"3679","vulnerable":"1","versionEndIncluding":"4.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"access_gateway","cpe6":"*","cpe7":"hf1","cpe8":"advanced","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"},{"cve_year":"2007","cve_id":"3679","vulnerable":"1","versionEndIncluding":"4.5.5","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"citrix","cpe5":"access_gateway","cpe6":"*","cpe7":"*","cpe8":"standard","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T14:28:51.285Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"37845","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/37845"},{"name":"ADV-2007-2583","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/2583"},{"name":"2916","tags":["third-party-advisory","x_refsource_SREASON","x_transferred"],"url":"http://securityreason.com/securityalert/2916"},{"name":"26143","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/26143"},{"name":"24975","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/24975"},{"name":"20070718 SYMSA-2007-006: Citrix EPA ActiveX Control Design Flaw","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/474204/100/0/threaded"},{"tags":["x_refsource_MISC","x_transferred"],"url":"http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.citrix.com/article/CTX113815"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://support.citrix.com/article/CTX114028"},{"name":"24865","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/24865"},{"name":"citrix-access-activex-plugin-code-execution(35511)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35511"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-07-18T00:00:00.000Z","descriptions":[{"lang":"en","value":"The Citrix EPA ActiveX control (aka the \"endpoint checking control\" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"37845","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/37845"},{"name":"ADV-2007-2583","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/2583"},{"name":"2916","tags":["third-party-advisory","x_refsource_SREASON"],"url":"http://securityreason.com/securityalert/2916"},{"name":"26143","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/26143"},{"name":"24975","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/24975"},{"name":"20070718 SYMSA-2007-006: Citrix EPA ActiveX Control Design Flaw","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/474204/100/0/threaded"},{"tags":["x_refsource_MISC"],"url":"http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.citrix.com/article/CTX113815"},{"tags":["x_refsource_CONFIRM"],"url":"http://support.citrix.com/article/CTX114028"},{"name":"24865","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/24865"},{"name":"citrix-access-activex-plugin-code-execution(35511)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35511"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-3679","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"The Citrix EPA ActiveX control (aka the \"endpoint checking control\" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"37845","refsource":"OSVDB","url":"http://osvdb.org/37845"},{"name":"ADV-2007-2583","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/2583"},{"name":"2916","refsource":"SREASON","url":"http://securityreason.com/securityalert/2916"},{"name":"26143","refsource":"SECUNIA","url":"http://secunia.com/advisories/26143"},{"name":"24975","refsource":"BID","url":"http://www.securityfocus.com/bid/24975"},{"name":"20070718 SYMSA-2007-006: Citrix EPA ActiveX Control Design Flaw","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/474204/100/0/threaded"},{"name":"http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt","refsource":"MISC","url":"http://www.symantec.com/content/en/us/enterprise/research/SYMSA-2007-006.txt"},{"name":"http://support.citrix.com/article/CTX113815","refsource":"CONFIRM","url":"http://support.citrix.com/article/CTX113815"},{"name":"http://support.citrix.com/article/CTX114028","refsource":"CONFIRM","url":"http://support.citrix.com/article/CTX114028"},{"name":"24865","refsource":"BID","url":"http://www.securityfocus.com/bid/24865"},{"name":"citrix-access-activex-plugin-code-execution(35511)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/35511"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-3679","datePublished":"2007-07-25T17:00:00.000Z","dateReserved":"2007-07-11T00:00:00.000Z","dateUpdated":"2024-08-07T14:28:51.285Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-07-25 17:30:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["NVD-CWE-Other","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:access_gateway:*:hf1:advanced:*:*:*:*:*","versionEndIncluding":"4.5","matchCriteriaId":"7A132506-353D-4128-82A2-46DBC000B753"},{"vulnerable":true,"criteria":"cpe:2.3:a:citrix:access_gateway:*:*:standard:*:*:*:*:*","versionEndIncluding":"4.5.5","matchCriteriaId":"47ABB5D2-79BD-48AC-877E-E671C7408362"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"3679","Ordinal":"1","Title":"CVE-2007-3679","CVE":"CVE-2007-3679","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"3679","Ordinal":"1","NoteData":"The Citrix EPA ActiveX control (aka the \"endpoint checking control\" or CCAOControl Object) before 4.5.0.0 in npCtxCAO.dll in Citrix Access Gateway Standard Edition before 4.5.5 and Advanced Edition before 4.5 HF1 allows remote attackers to download and execute arbitrary programs onto a client system.","Type":"Description","Title":"CVE-2007-3679"},{"CveYear":"2007","CveId":"3679","Ordinal":"2","NoteData":"2007-07-25","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"3679","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}