CVE-2007-0059 is a cross-zone scripting vulnerability affecting Apple QuickTime versions 3 through 7.1.3. It allows remote, user-assisted attackers to execute arbitrary code and list filesystem contents. The vulnerability is triggered by a specially crafted QuickTime movie (.MOV) containing an HREF Track with an automatic action tag pointing to a local URI, which is executed in a local zone during preview, as notably exploited by a MySpace worm. This vulnerability has a CVSS score of 6.8 (Medium), indicating a network-based attack with medium complexity requiring user interaction, leading to partial confidentiality, integrity, and availability impacts. Its FAUCET Risk Score is high at 92/100, and its EPSS score suggests a low likelihood of exploitation compared to most CVEs. While not listed in CISA's KEV catalog, an exploit (EDB-3077) is available on ExploitDB. Despite its age and the MySpace worm incident, there is currently no active Metasploit or Nuclei module, and it receives minimal community discussion or media coverage.
| Vendor | Product | Version(s) | CPE |
|---|---|---|---|
<= 7.1.3CPE matchmatch criteria | cpe:2.3:a:apple:quicktime:*:*:*:*:*:*:*:* | ||
3.0CPE matchmatch criteria | cpe:2.3:a:apple:quicktime:3.0:*:*:*:*:*:*:* |
CVSS version used by this source: 2.0
AV:N/AC:M/Au:N/C:P/I:P/A:P
No social media mentions found for this CVE.
The average CVE in this peer group has 0.0 Twitter, 0.0 Reddit, 0.0 Bluesky, 0.0 Mastodon, and 0.2 GitHub mentions.
No media coverage found for this CVE.
The average CVE in this peer group has 0.0 InfoSec Media, 0.0 Vendor Blog, and 0.0 Security Researcher mentions.
Remediation records are not available for this CVE.