CVE-2007-0220
MEDIUM · CVSS 6.8EPSS 33.1%EU EUVD
Cross-site scripting (XSS) vulnerability in Outlook Web Access (OWA) in Microsoft Exchange Server 2000 SP3, and 2003 SP1 and SP2 allows remote attackers to execute arbitrary scripts, spoof content, or obtain sensitive information via certain UTF-encoded, script-based e-mail attachments, involving an "incorrectly handled UTF character set label".
Key facts
- CVSS score
- 6.8 (v2.0)
- Severity
- MEDIUM
- CVSS vector
AV:N/AC:M/Au:N/C:P/I:P/A:P- Weakness (CWE)
- CWE-79
- EPSS score
- 33.1% (98th percentile)
- In CISA KEV
- No
- In EU EUVD
- Yes (EUVD-2007-0222)
- Published
- May 8, 2007
- NVD last modified
- June 16, 2026
- Status
- Modified
EU Vulnerability Database (EUVD)
This vulnerability is also tracked by ENISA as EUVD-2007-0222 in the EU Vulnerability Database. Last updated in EUVD on August 7, 2024.
View on the EU Vulnerability DatabaseAffected products
- microsoft / exchange server
- microsoft / exchange server
- microsoft / exchange server
References
- http://secunia.com/advisories/25183(Third Party Advisory)
- http://www.kb.cert.org/vuls/id/124113(Third Party Advisory, US Government Resource)
- http://www.osvdb.org/34389(Broken Link)
- http://www.securityfocus.com/archive/1/468871/100/200/threaded(Third Party Advisory, VDB Entry)
- http://www.securityfocus.com/bid/23806(Third Party Advisory, VDB Entry)
- http://www.securitytracker.com/id?1018015(Third Party Advisory, VDB Entry)
- http://www.us-cert.gov/cas/techalerts/TA07-128A.html(Third Party Advisory, US Government Resource)
- http://www.vupen.com/english/advisories/2007/1711(Permissions Required)
- https://docs.microsoft.com/en-us/security-updates/securitybulletins/2007/ms07-026(Patch)
- https://exchange.xforce.ibmcloud.com/vulnerabilities/33887(Third Party Advisory, VDB Entry)
- https://oval.cisecurity.org/repository/search/definition/oval%3Aorg.mitre.oval%3Adef%3A1371(Third Party Advisory)
Last updated September 17, 2026 · Source: NVD, CISA KEV, FIRST.org EPSS
Query CVEs from your AI assistant
The CVE/NVD Explorer brain answers CVE questions directly inside Claude, ChatGPT, or any MCP assistant — always up to date, no setup. Add it once and stop pasting advisories into chat.
Add the CVE brain