CVE-2007-4848

Severity: medium (CVSS 4.3 v2.0)
Exploited in the wild: not listed in CISA KEV
EPSS: 7.5% probability of exploitation in the next 30 days
Public exploit or detection template: yes
Published: 2007-09-12 · updated 2026-06-16

Description

Microsoft Internet Explorer 4.0 through 7 allows remote attackers to determine the existence of local files that have associated images via a res:// URI in the src property of a JavaScript Image object, as demonstrated by the URI for a bitmap image resource within a (1) .exe or (2) .dll file.

Affected products

Microsoft Ie: 4.x, 5.0-sp1, 5.0-sp4, 5.0_ta3, 5.x, 6.0-sp1 (+1)
Microsoft Internet Explorer 11: 4.0, 4.0.1, 4.1, 4.5, 5, 5.0 (+31)

References

http://osvdb.org/37638
http://xs-sniper.com/blog/2007/07/20/more-uri-stuff-ies-resouce-uri/
http://osvdb.org/37638
http://xs-sniper.com/blog/2007/07/20/more-uri-stuff-ies-resouce-uri/

Get alerted when CVE-2007-4848 or the next vulnerability affects your stack