{"api_version":"1","generated_at":"2026-07-23T05:44:16+00:00","cve":"CVE-2007-5472","urls":{"html":"https://cve.report/CVE-2007-5472","api":"https://cve.report/api/cve/CVE-2007-5472.json","docs":"https://cve.report/api","cve_org":"https://www.cve.org/CVERecord?id=CVE-2007-5472","nvd":"https://nvd.nist.gov/vuln/detail/CVE-2007-5472"},"summary":{"title":"CVE-2007-5472","description":"Cross-site scripting (XSS) vulnerability in the Server component in CA Host-Based Intrusion Prevention System (HIPS) before 8.0.0.93 allows remote attackers to inject arbitrary web script or HTML via requests that are written to logs for later display in the log viewer.","state":"PUBLISHED","assigner":"mitre","published_at":"2007-10-22 19:46:00","updated_at":"2026-04-23 00:35:47"},"problem_types":["CWE-79","n/a"],"metrics":[{"version":"2.0","source":"nvd@nist.gov","type":"Primary","score":"4.3","severity":"","vector":"AV:N/AC:M/Au:N/C:N/I:P/A:N","data":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"}}],"references":[{"url":"http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp","name":"http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch"],"title":"","mime":"text/html","httpstatus":"-1","archivestatus":"200"},{"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/37285","name":"https://exchange.xforce.ibmcloud.com/vulnerabilities/37285","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"IBM X-Force Exchange","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/archive/1/482536/100/0/threaded","name":"http://www.securityfocus.com/archive/1/482536/100/0/threaded","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"SecurityFocus","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://secunia.com/advisories/27301","name":"http://secunia.com/advisories/27301","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":["Patch","Vendor Advisory"],"title":"CA Host-Based Intrusion Prevention System Server Script Insertion - Advisories - Secunia","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://osvdb.org/37998","name":"http://osvdb.org/37998","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"","mime":"","httpstatus":"-1","archivestatus":"0"},{"url":"http://www.vupen.com/english/advisories/2007/3547","name":"http://www.vupen.com/english/advisories/2007/3547","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Webmail : Solution de messagerie professionnelle - OVHcloud- OVH","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://securitytracker.com/id?1018839","name":"http://securitytracker.com/id?1018839","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"CA Host-Based Intrusion Prevention System Input Validation Hole Permits Script Injection Attacks - SecurityTracker","mime":"text/html","httpstatus":"200","archivestatus":"200"},{"url":"http://www.securityfocus.com/bid/26134","name":"http://www.securityfocus.com/bid/26134","refsource":"af854a3a-2127-422b-91ae-364da2661108","tags":[],"title":"Computer Associates Host-Based Intrusion Prevention System Server HTML Injection Vulnerability","mime":"text/html","httpstatus":"200","archivestatus":"0"},{"url":"https://www.cve.org/CVERecord?id=CVE-2007-5472","name":"CVE Program record","refsource":"CVE.ORG","tags":["canonical"]},{"url":"https://nvd.nist.gov/vuln/detail/CVE-2007-5472","name":"NVD vulnerability detail","refsource":"NVD","tags":["canonical","analysis"]}],"affected":[{"source":"CNA","vendor":"n/a","product":"n/a","version":"affected n/a","platforms":[]}],"timeline":[],"solutions":[],"workarounds":[],"exploits":[],"credits":[],"nvd_cpes":[{"cve_year":"2007","cve_id":"5472","vulnerable":"1","versionEndIncluding":"8","cpe1":"cpe","cpe2":"2.3","cpe3":"a","cpe4":"broadcom","cpe5":"host-based_intrusion_prevention_system","cpe6":"*","cpe7":"*","cpe8":"*","cpe9":"*","cpe10":"*","cpe11":"*","cpe12":"*","cpe13":"*"}],"vendor_comments":[],"enrichments":{"kev":null,"epss":null,"legacy_qids":[]},"source_records":{"cve_program":{"containers":{"adp":[{"providerMetadata":{"dateUpdated":"2024-08-07T15:31:59.187Z","orgId":"af854a3a-2127-422b-91ae-364da2661108","shortName":"CVE"},"references":[{"name":"20071019 [CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ","x_transferred"],"url":"http://www.securityfocus.com/archive/1/482536/100/0/threaded"},{"tags":["x_refsource_CONFIRM","x_transferred"],"url":"http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp"},{"name":"1018839","tags":["vdb-entry","x_refsource_SECTRACK","x_transferred"],"url":"http://securitytracker.com/id?1018839"},{"name":"ca-hips-log-xss(37285)","tags":["vdb-entry","x_refsource_XF","x_transferred"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/37285"},{"name":"ADV-2007-3547","tags":["vdb-entry","x_refsource_VUPEN","x_transferred"],"url":"http://www.vupen.com/english/advisories/2007/3547"},{"name":"37998","tags":["vdb-entry","x_refsource_OSVDB","x_transferred"],"url":"http://osvdb.org/37998"},{"name":"26134","tags":["vdb-entry","x_refsource_BID","x_transferred"],"url":"http://www.securityfocus.com/bid/26134"},{"name":"27301","tags":["third-party-advisory","x_refsource_SECUNIA","x_transferred"],"url":"http://secunia.com/advisories/27301"}],"title":"CVE Program Container"}],"cna":{"affected":[{"product":"n/a","vendor":"n/a","versions":[{"status":"affected","version":"n/a"}]}],"datePublic":"2007-10-19T00:00:00.000Z","descriptions":[{"lang":"en","value":"Cross-site scripting (XSS) vulnerability in the Server component in CA Host-Based Intrusion Prevention System (HIPS) before 8.0.0.93 allows remote attackers to inject arbitrary web script or HTML via requests that are written to logs for later display in the log viewer."}],"problemTypes":[{"descriptions":[{"description":"n/a","lang":"en","type":"text"}]}],"providerMetadata":{"dateUpdated":"2018-10-15T20:57:01.000Z","orgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","shortName":"mitre"},"references":[{"name":"20071019 [CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability","tags":["mailing-list","x_refsource_BUGTRAQ"],"url":"http://www.securityfocus.com/archive/1/482536/100/0/threaded"},{"tags":["x_refsource_CONFIRM"],"url":"http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp"},{"name":"1018839","tags":["vdb-entry","x_refsource_SECTRACK"],"url":"http://securitytracker.com/id?1018839"},{"name":"ca-hips-log-xss(37285)","tags":["vdb-entry","x_refsource_XF"],"url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/37285"},{"name":"ADV-2007-3547","tags":["vdb-entry","x_refsource_VUPEN"],"url":"http://www.vupen.com/english/advisories/2007/3547"},{"name":"37998","tags":["vdb-entry","x_refsource_OSVDB"],"url":"http://osvdb.org/37998"},{"name":"26134","tags":["vdb-entry","x_refsource_BID"],"url":"http://www.securityfocus.com/bid/26134"},{"name":"27301","tags":["third-party-advisory","x_refsource_SECUNIA"],"url":"http://secunia.com/advisories/27301"}],"x_legacyV4Record":{"CVE_data_meta":{"ASSIGNER":"cve@mitre.org","ID":"CVE-2007-5472","STATE":"PUBLIC"},"affects":{"vendor":{"vendor_data":[{"product":{"product_data":[{"product_name":"n/a","version":{"version_data":[{"version_value":"n/a"}]}}]},"vendor_name":"n/a"}]}},"data_format":"MITRE","data_type":"CVE","data_version":"4.0","description":{"description_data":[{"lang":"eng","value":"Cross-site scripting (XSS) vulnerability in the Server component in CA Host-Based Intrusion Prevention System (HIPS) before 8.0.0.93 allows remote attackers to inject arbitrary web script or HTML via requests that are written to logs for later display in the log viewer."}]},"problemtype":{"problemtype_data":[{"description":[{"lang":"eng","value":"n/a"}]}]},"references":{"reference_data":[{"name":"20071019 [CAID 35754]: CA Host-Based Intrusion Prevention System (CA HIPS) Server Vulnerability","refsource":"BUGTRAQ","url":"http://www.securityfocus.com/archive/1/482536/100/0/threaded"},{"name":"http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp","refsource":"CONFIRM","url":"http://supportconnectw.ca.com/public/cahips/infodocs/cahips-secnotice.asp"},{"name":"1018839","refsource":"SECTRACK","url":"http://securitytracker.com/id?1018839"},{"name":"ca-hips-log-xss(37285)","refsource":"XF","url":"https://exchange.xforce.ibmcloud.com/vulnerabilities/37285"},{"name":"ADV-2007-3547","refsource":"VUPEN","url":"http://www.vupen.com/english/advisories/2007/3547"},{"name":"37998","refsource":"OSVDB","url":"http://osvdb.org/37998"},{"name":"26134","refsource":"BID","url":"http://www.securityfocus.com/bid/26134"},{"name":"27301","refsource":"SECUNIA","url":"http://secunia.com/advisories/27301"}]}}}},"cveMetadata":{"assignerOrgId":"8254265b-2729-46b6-b9e3-3dfca2d5bfca","assignerShortName":"mitre","cveId":"CVE-2007-5472","datePublished":"2007-10-22T19:00:00.000Z","dateReserved":"2007-10-16T00:00:00.000Z","dateUpdated":"2024-08-07T15:31:59.187Z","state":"PUBLISHED"},"dataType":"CVE_RECORD","dataVersion":"5.1"},"nvd":{"publishedDate":"2007-10-22 19:46:00","lastModifiedDate":"2026-04-23 00:35:47","problem_types":["CWE-79","n/a"],"metrics":{"cvssMetricV2":[{"source":"nvd@nist.gov","type":"Primary","cvssData":{"version":"2.0","vectorString":"AV:N/AC:M/Au:N/C:N/I:P/A:N","baseScore":4.3,"accessVector":"NETWORK","accessComplexity":"MEDIUM","authentication":"NONE","confidentialityImpact":"NONE","integrityImpact":"PARTIAL","availabilityImpact":"NONE"},"baseSeverity":"MEDIUM","exploitabilityScore":8.6,"impactScore":2.9,"acInsufInfo":false,"obtainAllPrivilege":false,"obtainUserPrivilege":false,"obtainOtherPrivilege":false,"userInteractionRequired":true}]},"configurations":[{"nodes":[{"operator":"OR","negate":false,"cpeMatch":[{"vulnerable":true,"criteria":"cpe:2.3:a:broadcom:host-based_intrusion_prevention_system:*:*:*:*:*:*:*:*","versionEndIncluding":"8","matchCriteriaId":"4B2DD0DC-4F04-430B-B91B-D7A0643C4532"}]}]}]},"legacy_mitre":{"record":{"CveYear":"2007","CveId":"5472","Ordinal":"1","Title":"CVE-2007-5472","CVE":"CVE-2007-5472","Year":"2007"},"notes":[{"CveYear":"2007","CveId":"5472","Ordinal":"1","NoteData":"Cross-site scripting (XSS) vulnerability in the Server component in CA Host-Based Intrusion Prevention System (HIPS) before 8.0.0.93 allows remote attackers to inject arbitrary web script or HTML via requests that are written to logs for later display in the log viewer.","Type":"Description","Title":"CVE-2007-5472"},{"CveYear":"2007","CveId":"5472","Ordinal":"2","NoteData":"2007-10-22","Type":"Other","Title":"Published"},{"CveYear":"2007","CveId":"5472","Ordinal":"3","NoteData":"2018-10-15","Type":"Other","Title":"Modified"}]}}}